CVE-2026-102695: 
Java vulnerability analysis and mitigation

CVE-2026-102695 is a vulnerability in OmniFaces' CombinedResourceHandler component, titled "Forged combined resource IDs are accepted without authenticity check." The handler accepts any structurally valid deflated and base64-encoded combined resource ID without verifying that the server originally issued it, enabling unauthenticated attackers to forge IDs and trigger decompression amplification, unbounded cache growth, and unauthorized resource disclosure. Affected versions span all major release lines: < 1.14.3, >= 2.0 and < 2.7.33, >= 3.0 and < 3.14.23, >= 4.0 and < 4.7.12, and >= 5.0 and < 5.4.2. The advisory was published by BalusC on July 23, 2026, with the CVE record received on October 14, 2026. The CVSS v3.1 base score is 8.2 (High) (GitHub Advisory).

The root cause is insufficient verification of data authenticity (CWE-345): combined resource IDs are deflate+base64-encoded resource lists that travel in the URL, but nothing cryptographically binds them to the issuing deployment. Three distinct consequences share this single root cause. First, decompression amplification (CWE-409): the unserializeURLSafe method had no output size limit, allowing a ~5 KB forged ID to inflate to ~2,000,000 characters (~380:1 ratio) held in memory per request. Second, unbounded cache growth: the serve path cached every distinct reconstructed ID in a static, eviction-free map, so each unique forged ID permanently consumed heap. Third, unauthorized resource disclosure (CWE-552): reconstructed identifiers were resolved via ResourceHandler.createResource and streamed without checking resource type; because jakarta.faces.RESOURCE_EXCLUDES (which defaults to blocking .xhtml) is only enforced by handleResourceRequest and not by createResource, a forged ID naming a Facelets file under /resources or META-INF/resources returns its raw source. In deployments using the wildcard CDN mapping, a forged ID referencing omnifaces.graphic can additionally trigger a blind server-side fetch whose destination is partly derived from the request Host header (GitHub Advisory, Fix Commit).

Successful exploitation by an unauthenticated, network-adjacent attacker can cause memory exhaustion (denial of service) through decompression amplification, permanent JVM heap growth via unbounded cache poisoning, and limited disclosure of Facelets source files (e.g., composite component .xhtml files) from the webapp resource tree or classpath META-INF/resources. In CDN wildcard-mapped deployments, a forged ID can additionally trigger a blind, deployment-dependent server-side HTTP fetch, though this does not constitute arbitrary-scheme or arbitrary-destination SSRF. The vulnerability does not provide arbitrary file read beyond what the Faces resource pipeline can resolve, and integrity is not affected (GitHub Advisory).

No public proof-of-concept exploit code or in-the-wild exploitation has been reported as of the disclosure date. The vulnerability requires no authentication, no user interaction, and no special privileges — only network access to an endpoint served by a vulnerable OmniFaces deployment. The EPSS score is 0.0, indicating low current exploitation probability, and the CVE is not listed in the CISA KEV catalog (GitHub Advisory, ENISA EUVD).

1. Reconnaissance: Identify web applications using OmniFaces CombinedResourceHandler by inspecting HTML source for combined resource URLs (typically containing a base64url-encoded query parameter such as ln=omnifaces.combined or similar patterns in JSF resource requests.
2. Craft a forged resource ID: Construct a list of resource identifiers — for DoS, use a highly compressible payload (e.g., repeated characters) that deflates to a small size but expands to near 2 MB when inflated; for disclosure, include a Facelets file path such as resources/components/myComponent.xhtml.
3. Encode the payload: Deflate-compress the crafted resource list, then base64url-encode it (replacing + with - and / with _) to produce a structurally valid combined resource ID.
4. Send the forged request: Issue an HTTP GET request to the application's combined resource endpoint with the forged ID in the URL, e.g., GET /javax.faces.resource/omnifaces.combined.js?ln=omnifaces.combined&v=<forged_id>.
5. Achieve objective: For DoS, repeat with unique forged IDs to exhaust heap via cache growth and per-request decompression; for disclosure, parse the HTTP response body to retrieve the raw Facelets source of the targeted .xhtml resource (GitHub Advisory, Fix Commit).

• Network: High volume of HTTP GET requests to JSF combined resource endpoints (e.g., URLs containing omnifaces.combined or equivalent combined resource library names) with unusually long or varied base64url-encoded query parameters from a single or rotating source IP.
• Logs: Application server access logs showing repeated requests to combined resource URLs with large or structurally unusual resource ID parameters; Java heap exhaustion warnings or OutOfMemoryError entries in server logs correlating with such requests.
• Process: JVM heap usage growing monotonically without GC relief, particularly in the static CombinedResourceInfo.CACHE map; thread dumps showing threads blocked in InflaterInputStream.read processing large inputs.
• File System / Response: HTTP responses to combined resource requests returning .xhtml Facelets source content (identifiable by <!DOCTYPE html>, <ui:composition>, or <cc:interface> tags) rather than CSS or JavaScript (GitHub Advisory).

Upgrade OmniFaces to one of the patched versions: 1.14.3, 2.7.33, 3.14.23, 4.7.12, or 5.4.2. The fix caps decompressed output at 64 KiB, restricts cache population to the render path only (so the serve path can no longer grow the cache), and enforces an allowlist requiring all inner resources to be .css or .js files before serving. As a temporary workaround if upgrading is not immediately possible, disable CombinedResourceHandler in the application configuration. Note that the three attack vectors (amplification, cache growth, resource disclosure) share a single root cause and cannot be independently mitigated — partial mitigations leave the vulnerability exploitable (GitHub Advisory, Fix Commit).

The vulnerability was reported by Daniel Birtwhistle and fixed by OmniFaces maintainer BalusC, who published the GitHub Security Advisory on July 23, 2026. The advisory notes this is a distinct root cause from the related CVE-2026-41883 (GHSA-vp6r-9m58-5xv8), which concerned EL evaluation order in the wildcard CDN path. No significant broader media coverage or notable community commentary beyond the official advisory has been identified (GitHub Advisory).