CVE-2026-102695
Description
A flaw was found in OmniFaces. The CombinedResourceHandler component accepts and processes combined resource identifiers without verifying that the server generated them. A remote, unauthenticated attacker can exploit this vulnerability by sending forged resource requests, triggering unbounded data decompression and filling internal caches. This can result in a Denial of Service (DoS) caused by memory exhaustion, as well as the limited disclosure of internal application resources.
Statement
An Important severity flaw was found in OmniFaces, a utility library for JavaServer Faces / Jakarta Faces. The CombinedResourceHandler component serves combined resources for any structurally valid combined resource identifier presented in the URL without verifying that the server originally issued it. A remote, unauthenticated attacker can exploit this by sending forged resource requests that trigger unbounded data decompression and permanently add attacker-controlled entries to a process-lifetime cache, resulting in memory exhaustion and denial of service of the application. Because jakarta.faces.RESOURCE_EXCLUDES is not enforced on this custom resource resolution path, forged identifiers can also lead to limited disclosure of internal application resources, such as Facelets source files under the webapp resource tree or META-INF/resources; arbitrary file read is not possible. Red Hat rates this flaw Important, consistent with the upstream severity, with a CVSS 3.1 score of 8.2 (AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:H). The vulnerable component is the upstream Maven artifact org.omnifaces:omnifaces, which is not shipped in any Red Hat product, so no Red Hat products or offerings are currently affected by this flaw.
Mitigation
Deployments that enable the OmniFaces CombinedResourceHandler can mitigate this issue by disabling it, which closes the vulnerable combined-resource serve path. Upgrading to a fixed upstream release also resolves the issue; fixed versions are 1.14.3, 2.7.33, 3.14.23, 4.7.12, and 5.4.2, depending on the OmniFaces branch in use. No Red Hat products are affected, so no Red Hat-specific update is required.
Understanding the Weakness (CWE)
Availability
Technical Impact: DoS: Resource Consumption (CPU); DoS: Resource Consumption (Memory); DoS: Resource Consumption (Other)
When allocating resources without limits, an attacker could prevent other systems, applications, or processes from accessing the same type of resource. It can be easy for an attacker to consume many resources by rapidly making many requests or causing larger resources to be used than is needed.
Frequently Asked Questions
Not sure what something means? Check out our Security Glossary.
Want to get errata notifications? Sign up here.
