Skip to content
Patch Next
Sign inAdd to your agent

← Public intelligence

Maven package

org.omnifaces:omnifaces

Open actionable advisories and recorded vendor fixes. This public package view has no inventory attached and cannot establish whether your deployment is affected. A vendor fix never resolves your finding; verify your installed version and the source guidance.

Open advisories

1 actionable advisory, newest first. Withdrawn advisories and news are excluded. Coverage is partial.

  1. High, CVSS 7.5MavenPublished

    OmniFaces: Forged combined-resource IDs and related output/push boundaries

    CVE-2026-102695 · GHSA-fp43-vj7g-pg92

    Affected
    • Maven org.omnifaces:omnifaces < 1.14.3; >= 2.0.0, < 2.7.33; >= 3.0.0, < 3.14.23; >= 4.0.0, < 4.7.12; >= 5.0.0, < 5.4.2
    Fixed in
    5.4.22.7.334.7.121.14.33.14.23· Vendor fix available
    Issue
    1. Forged combined-resource IDs CombinedResourceInfo accepts a path-derived ID without an authenticity check, inflates it without an output limit, converts it to attacker-selected resource identifiers, and retains unique IDs in an unbounded static cache. In bounded tests, 20,754 encoded bytes inflated to 16,000,000 characters (about 770:1; about 49 MB observed heap delta), and 200 unique IDs added 200 permanent cache entries. A legitimately shaped short ID remained about 1:1, while malformed input was rejected; the missing distinction is between a server-issued ID and an attacker-minted but structurally valid ID. The minimal application also confirmed three sink tails from the same forged-ID root: - A wildcard CDN mapping performed a server-side fetch and relayed the exact loopback-canary body. This requires the documented combined-resource and wildcard-CDN configuration. - A forged inner .xhtml resource bypassed the excluded-resource boundary and returned its raw content. - A forged…

    Recommended action: Upgrade to 5.4.2, 4.7.12, 3.14.23 or 2 more by release line, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.

    Sources:github.comSource checked Evidence →