{"api_version":"1","generated_at":"2026-10-22T14:08:54+00:00","cve":"CVE-2026-102695","urls":{"html":"https://cve.report/CVE-2026-102695","api":"https://cve.report/api/cve/CVE-2026-102695.json","docs":"https://cve.report/api","cve_org":"https://www.cve.org/CVERecord?id=CVE-2026-102695","nvd":"https://nvd.nist.gov/vuln/detail/CVE-2026-102695"},"summary":{"title":"OmniFaces: Forged combined-resource IDs and related output/push boundaries","description":"OmniFaces is a utility library for Faces. In OmniFaces versions before 1.14.3, 2.7.33, 3.14.23, 4.7.12, and 5.4.2, CombinedResourceHandler accepts a structurally valid deflated and base64 encoded combined resource ID without verifying that the server issued it. A forged ID can cause unbounded decoded output, add unique reconstructed IDs to a process-lifetime cache, or combine resources other than stylesheets and scripts. Because jakarta.faces.RESOURCE_EXCLUDES is not applied by this custom resolution path, a forged ID can disclose Facelets source from the webapp resource tree or META-INF/resources. In a deployment configured with the wildcard CDN mapping, a forged ID that selects omnifaces.graphic can also cause a blind, deployment-dependent server-side fetch whose destination derives partly from the request Host header. The flaw does not provide arbitrary file read or establish arbitrary-scheme or arbitrary-destination SSRF. The shared authenticity failure permits memory exhaustion and limited resource disclosure. This issue is fixed in versions 1.14.3, 2.7.33, 3.14.23, 4.7.12, and 5.4.2.","state":"PUBLISHED","assigner":"GitHub_M","published_at":"2026-10-14 16:17:29","updated_at":"2026-10-20 02:17:08"},"problem_types":["CWE-345","CWE-409","CWE-552","CWE-345 CWE-345: Insufficient Verification of Data Authenticity","CWE-409 CWE-409: Improper Handling of Highly Compressed Data (Data Amplification)","CWE-552 CWE-552: Files or Directories Accessible to External Parties"],"metrics":[{"version":"3.1","source":"security-advisories@github.com","type":"Secondary","score":"8.2","severity":"HIGH","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:H","data":{"version":"3.1","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:H","baseScore":8.2,"baseSeverity":"HIGH","attackVector":"NETWORK","attackComplexity":"LOW","privilegesRequired":"NONE","userInteraction":"NONE","scope":"UNCHANGED","confidentialityImpact":"LOW","integrityImpact":"NONE","availabilityImpact":"HIGH"}},{"version":"3.1","source":"CNA","type":"DECLARED","score":"8.2","severity":"HIGH","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:H","data":{"attackComplexity":"LOW","attackVector":"NETWORK","availabilityImpact":"HIGH","baseScore":8.2,"baseSeverity":"HIGH","confidentialityImpact":"LOW","integrityImpact":"NONE","privilegesRequired":"NONE","scope":"UNCHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:H","version":"3.1"}}],"references":[{"url":"https://github.com/omnifaces/omnifaces/security/advisories/GHSA-fp43-vj7g-pg92","name":"https://github.com/omnifaces/omnifaces/security/advisories/GHSA-fp43-vj7g-pg92","refsource":"security-advisories@github.com","tags":[],"title":"","mime":"","httpstatus":"","archivestatus":"0"},{"url":"https://github.com/omnifaces/omnifaces/releases/tag/4.7.12","name":"https://github.com/omnifaces/omnifaces/releases/tag/4.7.12","refsource":"security-advisories@github.com","tags":[],"title":"","mime":"","httpstatus":"","archivestatus":"0"},{"url":"https://github.com/omnifaces/omnifaces/releases/tag/1.14.3","name":"https://github.com/omnifaces/omnifaces/releases/tag/1.14.3","refsource":"security-advisories@github.com","tags":[],"title":"","mime":"","httpstatus":"","archivestatus":"0"},{"url":"https://github.com/omnifaces/omnifaces/commit/aa42da361821ddfbb85b126564e71587347d2786","name":"https://github.com/omnifaces/omnifaces/commit/aa42da361821ddfbb85b126564e71587347d2786","refsource":"security-advisories@github.com","tags":[],"title":"","mime":"","httpstatus":"","archivestatus":"0"},{"url":"https://github.com/omnifaces/omnifaces/releases/tag/5.4.2","name":"https://github.com/omnifaces/omnifaces/releases/tag/5.4.2","refsource":"security-advisories@github.com","tags":[],"title":"","mime":"","httpstatus":"","archivestatus":"0"},{"url":"https://github.com/omnifaces/omnifaces/releases/tag/2.7.33","name":"https://github.com/omnifaces/omnifaces/releases/tag/2.7.33","refsource":"security-advisories@github.com","tags":[],"title":"","mime":"","httpstatus":"","archivestatus":"0"},{"url":"https://github.com/omnifaces/omnifaces/releases/tag/3.14.23","name":"https://github.com/omnifaces/omnifaces/releases/tag/3.14.23","refsource":"security-advisories@github.com","tags":[],"title":"","mime":"","httpstatus":"","archivestatus":"0"},{"url":"https://www.cve.org/CVERecord?id=CVE-2026-102695","name":"CVE Program record","refsource":"CVE.ORG","tags":["canonical"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-102695","name":"NVD vulnerability detail","refsource":"NVD","tags":["canonical","analysis"]}],"affected":[{"source":"CNA","vendor":"omnifaces","product":"omnifaces","version":"affected < 1.14.3","platforms":[]},{"source":"CNA","vendor":"omnifaces","product":"omnifaces","version":"affected >= 2.0, < 2.7.33","platforms":[]},{"source":"CNA","vendor":"omnifaces","product":"omnifaces","version":"affected >= 3.0, < 3.14.23","platforms":[]},{"source":"CNA","vendor":"omnifaces","product":"omnifaces","version":"affected >= 4.0, < 4.7.12","platforms":[]},{"source":"CNA","vendor":"omnifaces","product":"omnifaces","version":"affected >= 5.0, < 5.4.2","platforms":[]}],"timeline":[],"solutions":[],"workarounds":[],"exploits":[],"credits":[],"nvd_cpes":[],"vendor_comments":[],"enrichments":{"kev":null,"epss":{"cve_year":"2026","cve_id":"102695","cve":"CVE-2026-102695","epss":"0.003060000","percentile":"0.219810000","score_date":"2026-10-20","updated_at":"2026-10-21 00:14:28"},"legacy_qids":[]},"source_records":{"cve_program":{"containers":{"adp":[{"metrics":[{"other":{"content":{"id":"CVE-2026-102695","options":[{"Exploitation":"none"},{"Automatable":"yes"},{"Technical Impact":"partial"}],"role":"CISA Coordinator","timestamp":"2026-10-20T01:38:04.247055Z","version":"2.0.3"},"type":"ssvc"}}],"providerMetadata":{"dateUpdated":"2026-10-20T01:38:15.296Z","orgId":"134c704f-9b21-4f2e-91b3-4a467353bcc0","shortName":"CISA-ADP"},"title":"CISA ADP Vulnrichment"}],"cna":{"affected":[{"product":"omnifaces","vendor":"omnifaces","versions":[{"status":"affected","version":"< 1.14.3"},{"status":"affected","version":">= 2.0, < 2.7.33"},{"status":"affected","version":">= 3.0, < 3.14.23"},{"status":"affected","version":">= 4.0, < 4.7.12"},{"status":"affected","version":">= 5.0, < 5.4.2"}]}],"descriptions":[{"lang":"en","value":"OmniFaces is a utility library for Faces. In OmniFaces versions before 1.14.3, 2.7.33, 3.14.23, 4.7.12, and 5.4.2, CombinedResourceHandler accepts a structurally valid deflated and base64 encoded combined resource ID without verifying that the server issued it. A forged ID can cause unbounded decoded output, add unique reconstructed IDs to a process-lifetime cache, or combine resources other than stylesheets and scripts. Because jakarta.faces.RESOURCE_EXCLUDES is not applied by this custom resolution path, a forged ID can disclose Facelets source from the webapp resource tree or META-INF/resources. In a deployment configured with the wildcard CDN mapping, a forged ID that selects omnifaces.graphic can also cause a blind, deployment-dependent server-side fetch whose destination derives partly from the request Host header. The flaw does not provide arbitrary file read or establish arbitrary-scheme or arbitrary-destination SSRF. The shared authenticity failure permits memory exhaustion and limited resource disclosure. This issue is fixed in versions 1.14.3, 2.7.33, 3.14.23, 4.7.12, and 5.4.2."}],"metrics":[{"cvssV3_1":{"attackComplexity":"LOW","attackVector":"NETWORK","availabilityImpact":"HIGH","baseScore":8.2,"baseSeverity":"HIGH","confidentialityImpact":"LOW","integrityImpact":"NONE","privilegesRequired":"NONE","scope":"UNCHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:H","version":"3.1"}}],"problemTypes":[{"descriptions":[{"cweId":"CWE-345","description":"CWE-345: Insufficient Verification of Data Authenticity","lang":"en","type":"CWE"}]},{"descriptions":[{"cweId":"CWE-409","description":"CWE-409: Improper Handling of Highly Compressed Data (Data Amplification)","lang":"en","type":"CWE"}]},{"descriptions":[{"cweId":"CWE-552","description":"CWE-552: Files or Directories Accessible to External Parties","lang":"en","type":"CWE"}]}],"providerMetadata":{"dateUpdated":"2026-10-14T15:58:43.159Z","orgId":"a0819718-46f1-4df5-94e2-005712e83aaa","shortName":"GitHub_M"},"references":[{"name":"https://github.com/omnifaces/omnifaces/security/advisories/GHSA-fp43-vj7g-pg92","tags":["x_refsource_CONFIRM"],"url":"https://github.com/omnifaces/omnifaces/security/advisories/GHSA-fp43-vj7g-pg92"},{"name":"https://github.com/omnifaces/omnifaces/commit/aa42da361821ddfbb85b126564e71587347d2786","tags":["x_refsource_MISC"],"url":"https://github.com/omnifaces/omnifaces/commit/aa42da361821ddfbb85b126564e71587347d2786"},{"name":"https://github.com/omnifaces/omnifaces/releases/tag/1.14.3","tags":["x_refsource_MISC"],"url":"https://github.com/omnifaces/omnifaces/releases/tag/1.14.3"},{"name":"https://github.com/omnifaces/omnifaces/releases/tag/2.7.33","tags":["x_refsource_MISC"],"url":"https://github.com/omnifaces/omnifaces/releases/tag/2.7.33"},{"name":"https://github.com/omnifaces/omnifaces/releases/tag/3.14.23","tags":["x_refsource_MISC"],"url":"https://github.com/omnifaces/omnifaces/releases/tag/3.14.23"},{"name":"https://github.com/omnifaces/omnifaces/releases/tag/4.7.12","tags":["x_refsource_MISC"],"url":"https://github.com/omnifaces/omnifaces/releases/tag/4.7.12"},{"name":"https://github.com/omnifaces/omnifaces/releases/tag/5.4.2","tags":["x_refsource_MISC"],"url":"https://github.com/omnifaces/omnifaces/releases/tag/5.4.2"}],"source":{"advisory":"GHSA-fp43-vj7g-pg92","discovery":"UNKNOWN"},"title":"OmniFaces: Forged combined-resource IDs and related output/push boundaries"}},"cveMetadata":{"assignerOrgId":"a0819718-46f1-4df5-94e2-005712e83aaa","assignerShortName":"GitHub_M","cveId":"CVE-2026-102695","datePublished":"2026-10-14T15:58:43.159Z","dateReserved":"2026-09-29T16:10:04.077Z","dateUpdated":"2026-10-20T01:38:15.296Z","state":"PUBLISHED"},"dataType":"CVE_RECORD","dataVersion":"5.2"},"nvd":{"publishedDate":"2026-10-14 16:17:29","lastModifiedDate":"2026-10-20 02:17:08","problem_types":["CWE-345","CWE-409","CWE-552","CWE-345 CWE-345: Insufficient Verification of Data Authenticity","CWE-409 CWE-409: Improper Handling of Highly Compressed Data (Data Amplification)","CWE-552 CWE-552: Files or Directories Accessible to External Parties"],"metrics":{"cvssMetricV31":[{"source":"security-advisories@github.com","type":"Secondary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:H","baseScore":8.2,"baseSeverity":"HIGH","attackVector":"NETWORK","attackComplexity":"LOW","privilegesRequired":"NONE","userInteraction":"NONE","scope":"UNCHANGED","confidentialityImpact":"LOW","integrityImpact":"NONE","availabilityImpact":"HIGH"},"exploitabilityScore":3.9,"impactScore":4.2}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"timestamp":"2026-10-20T01:38:04.247055Z","id":"CVE-2026-102695","options":[{"exploitation":"none"},{"automatable":"yes"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","version":"2.0.3"}}]},"configurations":[]},"legacy_mitre":{"record":{"CveYear":"2026","CveId":"102695","Ordinal":"1","Title":"OmniFaces: Forged combined-resource IDs and related output/push ","CVE":"CVE-2026-102695","Year":"2026"},"notes":[{"CveYear":"2026","CveId":"102695","Ordinal":"1","NoteData":"OmniFaces is a utility library for Faces. In OmniFaces versions before 1.14.3, 2.7.33, 3.14.23, 4.7.12, and 5.4.2, CombinedResourceHandler accepts a structurally valid deflated and base64 encoded combined resource ID without verifying that the server issued it. A forged ID can cause unbounded decoded output, add unique reconstructed IDs to a process-lifetime cache, or combine resources other than stylesheets and scripts. Because jakarta.faces.RESOURCE_EXCLUDES is not applied by this custom resolution path, a forged ID can disclose Facelets source from the webapp resource tree or META-INF/resources. In a deployment configured with the wildcard CDN mapping, a forged ID that selects omnifaces.graphic can also cause a blind, deployment-dependent server-side fetch whose destination derives partly from the request Host header. The flaw does not provide arbitrary file read or establish arbitrary-scheme or arbitrary-destination SSRF. The shared authenticity failure permits memory exhaustion and limited resource disclosure. This issue is fixed in versions 1.14.3, 2.7.33, 3.14.23, 4.7.12, and 5.4.2.","Type":"Description","Title":"OmniFaces: Forged combined-resource IDs and related output/push "}]}}}