Skip to content
Fencer Intel
high 8.2

CVE-2026-102695 json

OmniFaces: Forged combined-resource IDs and related output/push boundaries

published 3mo ago modified 21d ago also GHSA-fp43-vj7g-pg92 , EUVD-2026-101293

cvss
8.2
version 3.1, CNA
cisa kev
Not listed
not in CISA's catalog
epss
0.3%
EPSS 0.3% chance of exploitation in 30 days, percentile 23%
public exploits
0
none known

Summary

OmniFaces is a utility library for Faces. In OmniFaces versions before 1.14.3, 2.7.33, 3.14.23, 4.7.12, and 5.4.2, CombinedResourceHandler accepts a structurally valid deflated and base64 encoded combined resource ID without verifying that the server issued it. A forged ID can cause unbounded decoded output, add unique reconstructed IDs to a process-lifetime cache, or combine resources other than stylesheets and scripts. Because jakarta.faces.RESOURCE_EXCLUDES is not applied by this custom resolution path, a forged ID can disclose Facelets source from the webapp resource tree or META-INF/resources. In a deployment configured with the wildcard CDN mapping, a forged ID that selects omnifaces.graphic can also cause a blind, deployment-dependent server-side fetch whose destination derives partly from the request Host header. The flaw does not provide arbitrary file read or establish arbitrary-scheme or arbitrary-destination SSRF. The shared authenticity failure permits memory exhaustion and limited resource disclosure. This issue is fixed in versions 1.14.3, 2.7.33, 3.14.23, 4.7.12, and 5.4.2.

Patch / fix

  • maven org.omnifaces:omnifaces 1.14.3, 2.7.33, 3.14.23, 4.7.12, 5.4.2

Is CVE-2026-102695 in your dependencies? Fencer shows which of your repositories are affected as soon as an advisory lands, and opens the fix as a pull request.

Check with Fencer

Vendor advisories

What the vendors themselves say about their products: affected, fixed or not affected, and what to do.

red hat product security vex CVE-2026-102695 updated cvss 8.2

org.omnifaces/omnifaces: OmniFaces: Denial of Service via unverified combined resource identifiers

  • Red Hat All currently supported Red Hat products
    not affected: vulnerable code not present

Red Hat CSAF VEX © Red Hat, Inc., from https://security.access.redhat.com/data/csaf/v2/vex/; changed: reduced to product statuses and remediations. CC BY 4.0 · csaf

CISA SSVC

Exploitation
none
Automatable
yes
Technical impact
partial
Assessed
21d ago

Exploit prediction

0.31% chance of exploitation in the next 30 days, higher than 23% of all scored CVEs (FIRST EPSS, 2026-11-09).

CVSS scores

assigned by version score vector
CNA 3.1 8.2 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:H
GitHub 3.1 7.5 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

Affected packages

ecosystem package affected fixed in
maven org.omnifaces:omnifaces
<1.14.3
>=2.0.0, <2.7.33
>=3.0.0, <3.14.23
>=4.0.0, <4.7.12
>=5.0.0, <5.4.2
1.14.3
2.7.33
3.14.23
4.7.12
5.4.2

Affected products

  • omnifaces omnifaces

Classification

Weakness
  • CWE-345 Insufficient Verification of Data Authenticity
  • CWE-409 Improper Handling of Highly Compressed Data (Data Amplification)
  • CWE-552 Files or Directories Accessible to External Parties
  • CWE-770 Allocation of Resources Without Limits or Throttling
  • CWE-79 Improper Neutralization of Input During Web Page Generation
  • CWE-862 Missing Authorization

References

Sources

Fencer Intel keeps one entry per vulnerability: the CVE id wins, then GHSA, and records that alias each other are merged, except that two CVEs always keep separate entries. The same data is available as JSON.