CVE-2026-102695: OmniFaces: Forged combined-resource IDs and related output/push boundaries
OmniFaces is a utility library for Faces. In OmniFaces versions before 1.14.3, 2.7.33, 3.14.23, 4.7.12, and 5.4.2, CombinedResourceHandler accepts a structurally valid deflated and base64 encoded combined resource ID without verifying that the server issued it. A forged ID can cause unbounded decoded output, add unique reconstructed IDs to a process-lifetime cache, or combine resources other than stylesheets and scripts. Because jakarta.faces.RESOURCEEXCLUDES is not applied by this custom resolution path, a forged ID can disclose Facelets source from the webapp resource tree or META-INF/resources. In a deployment configured with the wildcard CDN mapping, a forged ID that selects omnifaces.graphic can also cause a blind, deployment-dependent server-side fetch whose destination derives partly from the request Host header. The flaw does not provide arbitrary file read or establish arbitrary-scheme or arbitrary-destination SSRF. The shared authenticity failure permits memory exhaustion and limited resource disclosure. This issue is fixed in versions 1.14.3, 2.7.33, 3.14.23, 4.7.12, and 5.4.2.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
OmniFacesto a version that resolves this vulnerability.Fixed in 5.4.2
Event History
Frequently Asked Questions
Which deployments are exposed to the server-side fetch behavior?
The blind server-side fetch behavior requires a deployment configured with the wildcard CDN mapping and a forged ID that selects omnifaces.graphic. Its destination is deployment-dependent and partly derived from the request Host header.
What can an unauthenticated attacker do with a forged resource ID?
An attacker can submit a structurally valid deflated and base64-encoded ID without needing the server to have issued it. This can produce unbounded decoded output, populate a process-lifetime cache with unique reconstructed IDs, combine non-stylesheet and non-script resources, and potentially disclose Facelets source from the webapp resource tree or META-INF/resources.
Does this issue enable arbitrary file reads or unrestricted SSRF?
No. The issue does not provide arbitrary file read, arbitrary-scheme SSRF, or arbitrary-destination SSRF.
How can the issue be remediated?
Upgrade to OmniFaces 1.14.3, 2.7.33, 3.14.23, 4.7.12, or 5.4.2, as applicable to the version line in use.