{"schema":"threatline.record/2","record":{"id":"CVE-2026-102695","aliases":["GHSA-fp43-vj7g-pg92"],"summary":"OmniFaces: Forged combined-resource IDs and related output/push boundaries","details":"## 1. Forged combined-resource IDs\n`CombinedResourceInfo` accepts a path-derived ID without an authenticity check,\ninflates it without an output limit, converts it to attacker-selected resource\nidentifiers, and retains unique IDs in an unbounded static cache. In bounded\ntests, 20,754 encoded bytes inflated to 16,000,000 characters (about 770:1;\nabout 49 MB observed heap delta), and 200 unique IDs added 200 permanent cache\nentries. A legitimately shaped short ID remained about 1:1, while malformed\ninput was rejected; the missing distinction is between a server-issued ID and\nan attacker-minted but structurally valid ID.\n\nThe minimal application also confirmed three sink tails from the same forged-ID\nroot:\n\n- A wildcard CDN mapping performed a server-side fetch and relayed the exact\n  loopback-canary body. This requires the documented combined-resource and\n  wildcard-CDN configuration.\n- A forged inner `.xhtml` resource bypassed the excluded-resource boundary and\n  returned its raw content.\n- A forged `omnifaces.graphic` inner resource plus a canary `Host` header caused\n  an outbound GET to that host. This result is blind and deployment-dependent;\n  I am not claiming arbitrary-scheme or arbitrary-destination SSRF.\n\nThese behaviors reproduce after the fix for CVE-2026-41883 /\nGHSA-vp6r-9m58-5xv8. That advisory concerned EL evaluation order in the wildcard\nCDN path. This report has a different root: unsigned combined IDs and missing\ndecode/cache bounds, with separately demonstrated residual sink behavior.\n\n## 2. Source-map cache \n\nWith the documented optional source-map handler above a synthetic resource\nhandler, 40 unique missing combined-resource requests grew the process-wide\nsource-map cache from 13 to 92 entries. It has no size or eviction bound. This\nhas a separate cache, configuration prerequisite, and fix from family 1.\n\n## 3. HashParam callback output\n\nA URL-fragment value containing a single-quote JavaScript payload was stored by\n`o:hashParam` and later written unescaped into the Ajax callback script. On the\nfollow-up Ajax render, real Chrome executed the canary\n`window.__omniXss=1337`. This requires a page using `o:hashParam` and the\nfollow-up Ajax render.\n\n## 4. Session/view push-channel replay \n\nA fresh WebSocket client with no HTTP cookie connected using a victim's\nsession-scoped channel ID and received the victim's subsequent push. The code\nchecks application-wide ID existence but does not bind the handshake to the\ncurrent HTTP session, despite the documented current-session guarantee. The\nUUID remains an unguessable bearer-token prerequisite; this is replay after\ntoken exposure, not brute force.\n\n## 5. Push idle-connection and fanout behavior \n\nTwelve independent clients joined one application-scoped channel and all 12\nreceived the same push. Current code sets every accepted session's maximum idle\ntimeout to zero, retains sessions in an unbounded per-channel queue, and walks\nthe full queue on each push. I am reporting the demonstrated mechanism as a\nbounded design weakness: container connection limits remain an outer bound,\nand I am not claiming unbounded heap growth from the 12-client test.\n\n## Intentionally excluded leads\n\n- A duplicate-Range response-amplification lead was disproved. Twenty-four\n  ranges produced only one response body because the stream wrapper closes\n  after the first range. I am not reporting it as a security issue.\n- The older `Servlets.facesRedirect` XML issue is fixed on the current branch.\n  I am not reporting it as a new current-upstream issue.\n\n## Expected invariants\n\n- Only server-issued combined IDs should be accepted; decoding and caches\n  should be bounded; excluded resources and dynamic handlers should not become\n  attacker-selected inner resources.\n- Dynamic URLs should not derive an outbound destination from an untrusted\n  `Host` header.\n- Source-map lookups should not create unbounded process-lifetime state.\n- `HashParam` values must be escaped for a JavaScript string inside an XML\n  CDATA callback.\n- Session/view push subscriptions should be bound to the owning HTTP session or\n  authenticated principal; idle limits and per-channel caps should remain\n  operator-controllable.\n\n## Suggested fixes and available evidence\n\n- Authenticate generated combined IDs with a per-deployment secret, cap\n  inflated output, bound the combined cache, and avoid caching failed loads.\n- Require an existing/registered inner resource before wildcard remapping and\n  reject excluded resource types at serve time.\n- Derive dynamic-resource origins from trusted configuration rather than the\n  request `Host` value.\n- Bound or evict the source-map cache.\n- Apply JavaScript-string plus CDATA-safe encoding to `HashParam` callback\n  values.\n- Capture and verify HTTP-session or principal ownership during the WebSocket\n  handshake; retain a finite idle timeout and configurable per-channel limits.\n\nDaniel Birtwhistle","categories":["Libraries & packages"],"product":"org.omnifaces:omnifaces","vendor":"omnifaces","ecosystem":"maven","affected_ranges":[{"source":"GitHub Advisory Database","source_url":"https://github.com/advisories/GHSA-fp43-vj7g-pg92","source_modified_at":"2026-10-14T15:58:55Z","fetched_at":"2026-10-23T18:42:43.628194Z","package":{"ecosystem":"maven","name":"org.omnifaces:omnifaces"},"range":"< 1.14.3"},{"source":"GitHub Advisory Database","source_url":"https://github.com/advisories/GHSA-fp43-vj7g-pg92","source_modified_at":"2026-10-14T15:58:55Z","fetched_at":"2026-10-23T18:42:43.628194Z","package":{"ecosystem":"maven","name":"org.omnifaces:omnifaces"},"range":">= 2.0.0, < 2.7.33"},{"source":"GitHub Advisory Database","source_url":"https://github.com/advisories/GHSA-fp43-vj7g-pg92","source_modified_at":"2026-10-14T15:58:55Z","fetched_at":"2026-10-23T18:42:43.628194Z","package":{"ecosystem":"maven","name":"org.omnifaces:omnifaces"},"range":">= 3.0.0, < 3.14.23"},{"source":"GitHub Advisory Database","source_url":"https://github.com/advisories/GHSA-fp43-vj7g-pg92","source_modified_at":"2026-10-14T15:58:55Z","fetched_at":"2026-10-23T18:42:43.628194Z","package":{"ecosystem":"maven","name":"org.omnifaces:omnifaces"},"range":">= 4.0.0, < 4.7.12"},{"source":"GitHub Advisory Database","source_url":"https://github.com/advisories/GHSA-fp43-vj7g-pg92","source_modified_at":"2026-10-14T15:58:55Z","fetched_at":"2026-10-23T18:42:43.628194Z","package":{"ecosystem":"maven","name":"org.omnifaces:omnifaces"},"range":">= 5.0.0, < 5.4.2"},{"source":"CVE List","source_url":"https://www.cve.org/CVERecord?id=CVE-2026-102695","source_modified_at":"2026-10-20T01:38:15.296Z","fetched_at":"2026-10-23T18:45:31.882637Z","product":"omnifaces","vendor":"omnifaces","versions":[{"version":"< 1.14.3","status":"affected"},{"version":">= 2.0, < 2.7.33","status":"affected"},{"version":">= 3.0, < 3.14.23","status":"affected"},{"version":">= 4.0, < 4.7.12","status":"affected"},{"version":">= 5.0, < 5.4.2","status":"affected"}],"defaultStatus":null},{"source":"OSV","source_url":"https://osv.dev/vulnerability/GHSA-fp43-vj7g-pg92","source_modified_at":"2026-10-14T16:15:04.201415342Z","fetched_at":"2026-10-23T18:45:31.882637Z","package":{"name":"org.omnifaces:omnifaces","ecosystem":"Maven","purl":"pkg:maven/org.omnifaces/omnifaces"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.14.3"}]}],"versions":["1.1","1.10","1.10-RC1","1.11","1.11-M1","1.11-RC1","1.11-RC2","1.12","1.12.1","1.13","1.14","1.14.1","1.14.2","1.2","1.3","1.4","1.4.1","1.5","1.6","1.6.1","1.6.2","1.6.3","1.7","1.8","1.8.1","1.8.2","1.8.3"]},{"source":"OSV","source_url":"https://osv.dev/vulnerability/GHSA-fp43-vj7g-pg92","source_modified_at":"2026-10-14T16:15:04.201415342Z","fetched_at":"2026-10-23T18:45:31.882637Z","package":{"name":"org.omnifaces:omnifaces","ecosystem":"Maven","purl":"pkg:maven/org.omnifaces/omnifaces"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"2.0.0"},{"fixed":"2.7.33"}]}],"versions":["2.0","2.1","2.1-RC1","2.1-RC2","2.2","2.2-RC1","2.2-RC2","2.3","2.3-RC1","2.4","2.4-RC1","2.4-RC2","2.5","2.5-RC1","2.5.1","2.6","2.6-RC1","2.6-RC2","2.6.1","2.6.2","2.6.3","2.6.4","2.6.5","2.6.6","2.6.7","2.6.8","2.6.9","2.7","2.7.1","2.7.10","2.7.11","2.7.12","2.7.13","2.7.14","2.7.15","2.7.16","2.7.17","2.7.18","2.7.19","2.7.2","2.7.20","2.7.21","2.7.22","2.7.23","2.7.24","2.7.25","2.7.26","2.7.27","2.7.28","2.7.29"]},{"source":"OSV","source_url":"https://osv.dev/vulnerability/GHSA-fp43-vj7g-pg92","source_modified_at":"2026-10-14T16:15:04.201415342Z","fetched_at":"2026-10-23T18:45:31.882637Z","package":{"name":"org.omnifaces:omnifaces","ecosystem":"Maven","purl":"pkg:maven/org.omnifaces/omnifaces"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"3.0.0"},{"fixed":"3.14.23"}]}],"versions":["3.0","3.1","3.10","3.10.1","3.11","3.11.1","3.11.2","3.12","3.13","3.13.1","3.13.2","3.13.3","3.13.4","3.14","3.14.1","3.14.10","3.14.11","3.14.12","3.14.13","3.14.14","3.14.15","3.14.16","3.14.17","3.14.18","3.14.19","3.14.2","3.14.20","3.14.21","3.14.22","3.14.3","3.14.4","3.14.5","3.14.6","3.14.7","3.14.8","3.14.9","3.2","3.3","3.3.1","3.4","3.4.1","3.5","3.6","3.6.1","3.7","3.7.1","3.8","3.8.1","3.9"]},{"source":"OSV","source_url":"https://osv.dev/vulnerability/GHSA-fp43-vj7g-pg92","source_modified_at":"2026-10-14T16:15:04.201415342Z","fetched_at":"2026-10-23T18:45:31.882637Z","package":{"name":"org.omnifaces:omnifaces","ecosystem":"Maven","purl":"pkg:maven/org.omnifaces/omnifaces"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"4.0.0"},{"fixed":"4.7.12"}]}],"versions":["4.0","4.0.1","4.1","4.2","4.3","4.4","4.4.1","4.5","4.5.1","4.6","4.6.1","4.6.2","4.6.3","4.6.4","4.6.5","4.7","4.7.1","4.7.10","4.7.11","4.7.2","4.7.3","4.7.4","4.7.5","4.7.6","4.7.7","4.7.8","4.7.9"]},{"source":"OSV","source_url":"https://osv.dev/vulnerability/GHSA-fp43-vj7g-pg92","source_modified_at":"2026-10-14T16:15:04.201415342Z","fetched_at":"2026-10-23T18:45:31.882637Z","package":{"name":"org.omnifaces:omnifaces","ecosystem":"Maven","purl":"pkg:maven/org.omnifaces/omnifaces"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"5.0.0"},{"fixed":"5.4.2"}]}],"versions":["5.0","5.1","5.2","5.2.1","5.2.2","5.2.3","5.3","5.3-M1","5.3.1","5.3.2","5.3.3","5.3.4","5.4","5.4.1"]}],"fixed_versions":[{"source":"GitHub Advisory Database","source_url":"https://github.com/advisories/GHSA-fp43-vj7g-pg92","source_modified_at":"2026-10-14T15:58:55Z","fetched_at":"2026-10-23T18:42:43.628194Z","package":{"ecosystem":"maven","name":"org.omnifaces:omnifaces"},"version":"1.14.3"},{"source":"GitHub Advisory Database","source_url":"https://github.com/advisories/GHSA-fp43-vj7g-pg92","source_modified_at":"2026-10-14T15:58:55Z","fetched_at":"2026-10-23T18:42:43.628194Z","package":{"ecosystem":"maven","name":"org.omnifaces:omnifaces"},"version":"2.7.33"},{"source":"GitHub Advisory Database","source_url":"https://github.com/advisories/GHSA-fp43-vj7g-pg92","source_modified_at":"2026-10-14T15:58:55Z","fetched_at":"2026-10-23T18:42:43.628194Z","package":{"ecosystem":"maven","name":"org.omnifaces:omnifaces"},"version":"3.14.23"},{"source":"GitHub Advisory Database","source_url":"https://github.com/advisories/GHSA-fp43-vj7g-pg92","source_modified_at":"2026-10-14T15:58:55Z","fetched_at":"2026-10-23T18:42:43.628194Z","package":{"ecosystem":"maven","name":"org.omnifaces:omnifaces"},"version":"4.7.12"},{"source":"GitHub Advisory Database","source_url":"https://github.com/advisories/GHSA-fp43-vj7g-pg92","source_modified_at":"2026-10-14T15:58:55Z","fetched_at":"2026-10-23T18:42:43.628194Z","package":{"ecosystem":"maven","name":"org.omnifaces:omnifaces"},"version":"5.4.2"},{"source":"OSV","source_url":"https://osv.dev/vulnerability/GHSA-fp43-vj7g-pg92","source_modified_at":"2026-10-14T16:15:04.201415342Z","fetched_at":"2026-10-23T18:45:31.882637Z","package":{"name":"org.omnifaces:omnifaces","ecosystem":"Maven","purl":"pkg:maven/org.omnifaces/omnifaces"},"version":"1.14.3"},{"source":"OSV","source_url":"https://osv.dev/vulnerability/GHSA-fp43-vj7g-pg92","source_modified_at":"2026-10-14T16:15:04.201415342Z","fetched_at":"2026-10-23T18:45:31.882637Z","package":{"name":"org.omnifaces:omnifaces","ecosystem":"Maven","purl":"pkg:maven/org.omnifaces/omnifaces"},"version":"2.7.33"},{"source":"OSV","source_url":"https://osv.dev/vulnerability/GHSA-fp43-vj7g-pg92","source_modified_at":"2026-10-14T16:15:04.201415342Z","fetched_at":"2026-10-23T18:45:31.882637Z","package":{"name":"org.omnifaces:omnifaces","ecosystem":"Maven","purl":"pkg:maven/org.omnifaces/omnifaces"},"version":"3.14.23"},{"source":"OSV","source_url":"https://osv.dev/vulnerability/GHSA-fp43-vj7g-pg92","source_modified_at":"2026-10-14T16:15:04.201415342Z","fetched_at":"2026-10-23T18:45:31.882637Z","package":{"name":"org.omnifaces:omnifaces","ecosystem":"Maven","purl":"pkg:maven/org.omnifaces/omnifaces"},"version":"4.7.12"},{"source":"OSV","source_url":"https://osv.dev/vulnerability/GHSA-fp43-vj7g-pg92","source_modified_at":"2026-10-14T16:15:04.201415342Z","fetched_at":"2026-10-23T18:45:31.882637Z","package":{"name":"org.omnifaces:omnifaces","ecosystem":"Maven","purl":"pkg:maven/org.omnifaces/omnifaces"},"version":"5.4.2"}],"cvss":7.5,"severity":"High","kev":{"listed":false},"epss":{"probability":0.00306,"percentile":0.22188,"score_date":"2026-10-23"},"published_at":"2026-10-14T15:58:43.159Z","modified_at":"2026-10-20T01:38:15.296Z","provenance":[{"source":"GitHub Advisory Database","url":"https://github.com/advisories/GHSA-fp43-vj7g-pg92","fetched_at":"2026-10-23T18:42:43.628194Z","source_modified_at":"2026-10-14T15:58:55Z"},{"source":"CVE List","url":"https://www.cve.org/CVERecord?id=CVE-2026-102695","fetched_at":"2026-10-23T18:45:31.882637Z","source_modified_at":"2026-10-20T01:38:15.296Z"},{"source":"OSV","url":"https://osv.dev/vulnerability/GHSA-fp43-vj7g-pg92","fetched_at":"2026-10-23T18:45:31.882637Z","source_modified_at":"2026-10-14T16:15:04.201415342Z"},{"source":"EPSS","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-102695","fetched_at":"2026-10-23T18:42:43.628194Z","source_modified_at":"2026-10-23"}],"sources":["GitHub Advisory Database","CVE List","OSV","EPSS"],"references":[{"source":"CVE List","url":"https://github.com/omnifaces/omnifaces/security/advisories/GHSA-fp43-vj7g-pg92","tags":["x_refsource_CONFIRM"]},{"url":"https://github.com/omnifaces/omnifaces/commit/59d6c5188c39418546fe500d05036645987a77d1","source":"GitHub Advisory Database"},{"url":"https://github.com/omnifaces/omnifaces/commit/a52b92461cf39d983f51ce8724fe7e6b944073e4","source":"GitHub Advisory Database"},{"source":"CVE List","url":"https://github.com/omnifaces/omnifaces/commit/aa42da361821ddfbb85b126564e71587347d2786","tags":["x_refsource_MISC"]},{"url":"https://github.com/omnifaces/omnifaces/commit/c43eef01174a4dc09cec44eff553ff6284150af7","source":"GitHub Advisory Database"},{"url":"https://github.com/omnifaces/omnifaces/commit/d5cae243c4692555efaa4ba774e0f8f60e3f4db5","source":"GitHub Advisory Database"},{"url":"https://github.com/advisories/GHSA-fp43-vj7g-pg92","source":"GitHub Advisory Database"},{"source":"CVE List","url":"https://github.com/omnifaces/omnifaces/releases/tag/1.14.3","tags":["x_refsource_MISC"]},{"source":"CVE List","url":"https://github.com/omnifaces/omnifaces/releases/tag/2.7.33","tags":["x_refsource_MISC"]},{"source":"CVE List","url":"https://github.com/omnifaces/omnifaces/releases/tag/3.14.23","tags":["x_refsource_MISC"]},{"source":"CVE List","url":"https://github.com/omnifaces/omnifaces/releases/tag/4.7.12","tags":["x_refsource_MISC"]},{"source":"CVE List","url":"https://github.com/omnifaces/omnifaces/releases/tag/5.4.2","tags":["x_refsource_MISC"]}],"locations":[],"motoko_assessment":{"status":"requires_architecture_review","automatic_remediation":false},"cve_state":"PUBLISHED","ssvc":{"exploitation":"none","automatable":"yes","technical_impact":"partial","assessed_at":"2026-10-20T01:38:04.247055Z"},"classification":{"method":"product-first software-layer rules","rules_version":"2.1","matched_on":"ecosystem","confidence":"heuristic","reviewed":false},"change_timestamp":"2026-10-20T01:38:15.296Z","content_hash":"fbab0ffee666deca8f043933347f7b4e7fdc164974a50329e2399af9adb2b1ea"}}