CVE-2026-102695

Name of the Vulnerable Software and Affected Versions OmniFaces versions prior to 1.14.3 OmniFaces versions prior to 2.7.33 OmniFaces versions prior to 3.14.23 OmniFaces versions prior to 4.7.12 OmniFaces versions prior to 5.4.2

Description CombinedResourceHandler accepts structurally valid deflated and base64 encoded combined resource IDs without verifying if the server issued them. This allows a forged ID to cause unbounded decoded output, add unique reconstructed IDs to a process-lifetime cache, or combine resources other than scripts and stylesheets. Because jakarta.faces.RESOURCE EXCLUDES is not applied, a forged ID can disclose Facelets source from the webapp resource tree or META-INF/resources. In deployments using wildcard CDN mapping, a forged ID selecting omnifaces.graphic can trigger a blind, deployment-dependent server-side fetch where the destination is partly derived from the request Host header. This issue leads to memory exhaustion and limited resource disclosure.

Recommendations Update OmniFaces to version 1.14.3 or later. Update OmniFaces to version 2.7.33 or later. Update OmniFaces to version 3.14.23 or later. Update OmniFaces to version 4.7.12 or later. Update OmniFaces to version 5.4.2 or later.