CVE-2026-102695GHSA-fp43-vj7g-pg92

org.omnifaces:omnifaces: OmniFaces: Forged combined-resource IDs and related output/push boundaries

omnifaces org.omnifaces:omnifacesmavenLibraries & packages

CVSS

7.5High

ExploitationNo known exploitationNot in CISA KEV, which does not prove it is unexploitedCISA KEV

Exploit odds (EPSS)0.31%Chance of exploitation activity in the next 30 days, higher than 22% of CVEs. Scored 23 Oct 2026FIRST EPSS

Fixed in1.14.3Also 2.7.33, 3.14.23 and 2 moreGitHub

Published14 Oct 2026Updated 20 Oct 2026CVE List

What fixes it

1.14.3org.omnifaces:omnifaces, mavenGitHub<dependency><groupId>org.omnifaces</groupId><artifactId>omnifaces</artifactId><version>1.14.3</version></dependency>
2.7.33org.omnifaces:omnifaces, mavenGitHub<dependency><groupId>org.omnifaces</groupId><artifactId>omnifaces</artifactId><version>2.7.33</version></dependency>
3.14.23org.omnifaces:omnifaces, mavenGitHub<dependency><groupId>org.omnifaces</groupId><artifactId>omnifaces</artifactId><version>3.14.23</version></dependency>
4.7.12org.omnifaces:omnifaces, mavenGitHub<dependency><groupId>org.omnifaces</groupId><artifactId>omnifaces</artifactId><version>4.7.12</version></dependency>
5.4.2org.omnifaces:omnifaces, mavenGitHub<dependency><groupId>org.omnifaces</groupId><artifactId>omnifaces</artifactId><version>5.4.2</version></dependency>
1.14.3org.omnifaces:omnifaces, MavenOSV<dependency><groupId>org.omnifaces</groupId><artifactId>omnifaces</artifactId><version>1.14.3</version></dependency>

Show all 10 fixed versions

2.7.33org.omnifaces:omnifaces, MavenOSV<dependency><groupId>org.omnifaces</groupId><artifactId>omnifaces</artifactId><version>2.7.33</version></dependency>
3.14.23org.omnifaces:omnifaces, MavenOSV<dependency><groupId>org.omnifaces</groupId><artifactId>omnifaces</artifactId><version>3.14.23</version></dependency>
4.7.12org.omnifaces:omnifaces, MavenOSV<dependency><groupId>org.omnifaces</groupId><artifactId>omnifaces</artifactId><version>4.7.12</version></dependency>
5.4.2org.omnifaces:omnifaces, MavenOSV<dependency><groupId>org.omnifaces</groupId><artifactId>omnifaces</artifactId><version>5.4.2</version></dependency>

A fixed version on one release line is not the upgrade target for every line. Check your exact version and any vendor backports.

Description

1. Forged combined-resource IDs

CombinedResourceInfo accepts a path-derived ID without an authenticity check, inflates it without an output limit, converts it to attacker-selected resource identifiers, and retains unique IDs in an unbounded static cache. In bounded tests, 20,754 encoded bytes inflated to 16,000,000 characters (about 770:1; about 49 MB observed heap delta), and 200 unique IDs added 200 permanent cache entries. A legitimately shaped short ID remained about 1:1, while malformed input was rejected; the missing distinction is between a server-issued ID and an attacker-minted but structurally valid ID.

The minimal application also confirmed three sink tails from the same forged-ID root:

A wildcard CDN mapping performed a server-side fetch and relayed the exact

loopback-canary body. This requires the documented combined-resource and wildcard-CDN configuration.

A forged inner .xhtml resource bypassed the excluded-resource boundary and

returned its raw content.

A forged omnifaces.graphic inner resource plus a canary Host header caused

an outbound GET to that host. This result is blind and deployment-dependent; I am not claiming arbitrary-scheme or arbitrary-destination SSRF.

These behaviors reproduce after the fix for CVE-2026-41883 / GHSA-vp6r-9m58-5xv8. That advisory concerned EL evaluation order in the wildcard CDN path. This report has a different root: unsigned combined IDs and missing decode/cache bounds, with separately demonstrated residual sink behavior.

2. Source-map cache

With the documented optional source-map handler above a synthetic resource handler, 40 unique missing combined-resource requests grew the process-wide source-map cache from 13 to 92 entries. It has no size or eviction bound. This has a separate cache, configuration prerequisite, and fix from family 1.

3. HashParam callback output

A URL-fragment value containing a single-quote JavaScript payload was stored by o:hashParam and later written unescaped into the Ajax callback script. On the follow-up Ajax render, real Chrome executed the canary window.__omniXss=1337. This requires a page using o:hashParam and the follow-up Ajax render.

4. Session/view push-channel replay

A fresh WebSocket client with no HTTP cookie connected using a victim's session-scoped channel ID and received the victim's subsequent push. The code checks application-wide ID existence but does not bind the handshake to the current HTTP session, despite the documented current-session guarantee. The UUID remains an unguessable bearer-token prerequisite; this is replay after token exposure, not brute force.

5. Push idle-connection and fanout behavior

Twelve independent clients joined one application-scoped channel and all 12 received the same push. Current code sets every accepted session's maximum idle timeout to zero, retains sessions in an unbounded per-channel queue, and walks the full queue on each push. I am reporting the demonstrated mechanism as a bounded design weakness: container connection limits remain an outer bound, and I am not claiming unbounded heap growth from the 12-client test.

Intentionally excluded leads

A duplicate-Range response-amplification lead was disproved. Twenty-four

ranges produced only one response body because the stream wrapper closes after the first range. I am not reporting it as a security issue.

The older Servlets.facesRedirect XML issue is fixed on the current branch.

I am not reporting it as a new current-upstream issue.

Expected invariants

Only server-issued combined IDs should be accepted; decoding and caches

should be bounded; excluded resources and dynamic handlers should not become attacker-selected inner resources.

Dynamic URLs should not derive an outbound destination from an untrusted

Host header.

Source-map lookups should not create unbounded process-lifetime state.
HashParam values must be escaped for a JavaScript string inside an XML

CDATA callback.

Session/view push subscriptions should be bound to the owning HTTP session or

authenticated principal; idle limits and per-channel caps should remain operator-controllable.

Suggested fixes and available evidence

Authenticate generated combined IDs with a per-deployment secret, cap

inflated output, bound the combined cache, and avoid caching failed loads.

Require an existing/registered inner resource before wildcard remapping and

reject excluded resource types at serve time.

Derive dynamic-resource origins from trusted configuration rather than the

request Host value.

Bound or evict the source-map cache.
Apply JavaScript-string plus CDATA-safe encoding to HashParam callback

values.

Capture and verify HTTP-session or principal ownership during the WebSocket

handshake; retain a finite idle timeout and configurable per-channel limits.

Daniel Birtwhistle

Text from GitHub Advisory Database

Affected versions 182

org.omnifaces:omnifaces, maven< 1.14.3GitHub
org.omnifaces:omnifaces, maven>= 2.0.0, < 2.7.33GitHub
org.omnifaces:omnifaces, maven>= 3.0.0, < 3.14.23GitHub
org.omnifaces:omnifaces, maven>= 4.0.0, < 4.7.12GitHub
org.omnifaces:omnifaces, maven>= 5.0.0, < 5.4.2GitHub
omnifacesaffected: < 1.14.3CVE List
omnifacesaffected: >= 2.0, < 2.7.33CVE List
omnifacesaffected: >= 3.0, < 3.14.23CVE List
omnifacesaffected: >= 4.0, < 4.7.12CVE List
omnifacesaffected: >= 5.0, < 5.4.2CVE List
org.omnifaces:omnifaces, Mavenfrom first release, fixed in 1.14.3OSV
org.omnifaces:omnifaces, Maven1.1OSV
org.omnifaces:omnifaces, Maven1.10OSV
org.omnifaces:omnifaces, Maven1.10-RC1OSV
org.omnifaces:omnifaces, Maven1.11OSV
org.omnifaces:omnifaces, Maven1.11-M1OSV
org.omnifaces:omnifaces, Maven1.11-RC1OSV
org.omnifaces:omnifaces, Maven1.11-RC2OSV
org.omnifaces:omnifaces, Maven1.12OSV
org.omnifaces:omnifaces, Maven1.12.1OSV
org.omnifaces:omnifaces, Maven1.13OSV
org.omnifaces:omnifaces, Maven1.14OSV
org.omnifaces:omnifaces, Maven1.14.1OSV
org.omnifaces:omnifaces, Maven1.14.2OSV
org.omnifaces:omnifaces, Maven1.2OSV
org.omnifaces:omnifaces, Maven1.3OSV
org.omnifaces:omnifaces, Maven1.4OSV
org.omnifaces:omnifaces, Maven1.4.1OSV
org.omnifaces:omnifaces, Maven1.5OSV
org.omnifaces:omnifaces, Maven1.6OSV
org.omnifaces:omnifaces, Maven1.6.1OSV
org.omnifaces:omnifaces, Maven1.6.2OSV
org.omnifaces:omnifaces, Maven1.6.3OSV
org.omnifaces:omnifaces, Maven1.7OSV
org.omnifaces:omnifaces, Maven1.8OSV
org.omnifaces:omnifaces, Maven1.8.1OSV
org.omnifaces:omnifaces, Maven1.8.2OSV
org.omnifaces:omnifaces, Maven1.8.3OSV
org.omnifaces:omnifaces, Mavenfrom 2.0.0, fixed in 2.7.33OSV
org.omnifaces:omnifaces, Maven2.0OSV
org.omnifaces:omnifaces, Maven2.1OSV
org.omnifaces:omnifaces, Maven2.1-RC1OSV
org.omnifaces:omnifaces, Maven2.1-RC2OSV
org.omnifaces:omnifaces, Maven2.2OSV
org.omnifaces:omnifaces, Maven2.2-RC1OSV
org.omnifaces:omnifaces, Maven2.2-RC2OSV
org.omnifaces:omnifaces, Maven2.3OSV
org.omnifaces:omnifaces, Maven2.3-RC1OSV
org.omnifaces:omnifaces, Maven2.4OSV
org.omnifaces:omnifaces, Maven2.4-RC1OSV
org.omnifaces:omnifaces, Maven2.4-RC2OSV
org.omnifaces:omnifaces, Maven2.5OSV
org.omnifaces:omnifaces, Maven2.5-RC1OSV
org.omnifaces:omnifaces, Maven2.5.1OSV
org.omnifaces:omnifaces, Maven2.6OSV
org.omnifaces:omnifaces, Maven2.6-RC1OSV
org.omnifaces:omnifaces, Maven2.6-RC2OSV
org.omnifaces:omnifaces, Maven2.6.1OSV
org.omnifaces:omnifaces, Maven2.6.2OSV
org.omnifaces:omnifaces, Maven2.6.3OSV
org.omnifaces:omnifaces, Maven2.6.4OSV
org.omnifaces:omnifaces, Maven2.6.5OSV
org.omnifaces:omnifaces, Maven2.6.6OSV
org.omnifaces:omnifaces, Maven2.6.7OSV
org.omnifaces:omnifaces, Maven2.6.8OSV
org.omnifaces:omnifaces, Maven2.6.9OSV
org.omnifaces:omnifaces, Maven2.7OSV
org.omnifaces:omnifaces, Maven2.7.1OSV
org.omnifaces:omnifaces, Maven2.7.10OSV
org.omnifaces:omnifaces, Maven2.7.11OSV
org.omnifaces:omnifaces, Maven2.7.12OSV
org.omnifaces:omnifaces, Maven2.7.13OSV
org.omnifaces:omnifaces, Maven2.7.14OSV
org.omnifaces:omnifaces, Maven2.7.15OSV
org.omnifaces:omnifaces, Maven2.7.16OSV
org.omnifaces:omnifaces, Maven2.7.17OSV
org.omnifaces:omnifaces, Maven2.7.18OSV
org.omnifaces:omnifaces, Maven2.7.19OSV
org.omnifaces:omnifaces, Maven2.7.2OSV
org.omnifaces:omnifaces, Maven2.7.20OSV
org.omnifaces:omnifaces, Maven2.7.21OSV
org.omnifaces:omnifaces, Maven2.7.22OSV
org.omnifaces:omnifaces, Maven2.7.23OSV
org.omnifaces:omnifaces, Maven2.7.24OSV
org.omnifaces:omnifaces, Maven2.7.25OSV
org.omnifaces:omnifaces, Maven2.7.26OSV
org.omnifaces:omnifaces, Maven2.7.27OSV
org.omnifaces:omnifaces, Maven2.7.28OSV
org.omnifaces:omnifaces, Maven2.7.29OSV
org.omnifaces:omnifaces, Mavenfrom 3.0.0, fixed in 3.14.23OSV
org.omnifaces:omnifaces, Maven3.0OSV
org.omnifaces:omnifaces, Maven3.1OSV
org.omnifaces:omnifaces, Maven3.10OSV
org.omnifaces:omnifaces, Maven3.10.1OSV
org.omnifaces:omnifaces, Maven3.11OSV
org.omnifaces:omnifaces, Maven3.11.1OSV
org.omnifaces:omnifaces, Maven3.11.2OSV
org.omnifaces:omnifaces, Maven3.12OSV
org.omnifaces:omnifaces, Maven3.13OSV
org.omnifaces:omnifaces, Maven3.13.1OSV
org.omnifaces:omnifaces, Maven3.13.2OSV
org.omnifaces:omnifaces, Maven3.13.3OSV
org.omnifaces:omnifaces, Maven3.13.4OSV
org.omnifaces:omnifaces, Maven3.14OSV
org.omnifaces:omnifaces, Maven3.14.1OSV
org.omnifaces:omnifaces, Maven3.14.10OSV
org.omnifaces:omnifaces, Maven3.14.11OSV
org.omnifaces:omnifaces, Maven3.14.12OSV
org.omnifaces:omnifaces, Maven3.14.13OSV
org.omnifaces:omnifaces, Maven3.14.14OSV
org.omnifaces:omnifaces, Maven3.14.15OSV
org.omnifaces:omnifaces, Maven3.14.16OSV
org.omnifaces:omnifaces, Maven3.14.17OSV
org.omnifaces:omnifaces, Maven3.14.18OSV
org.omnifaces:omnifaces, Maven3.14.19OSV
org.omnifaces:omnifaces, Maven3.14.2OSV
org.omnifaces:omnifaces, Maven3.14.20OSV
org.omnifaces:omnifaces, Maven3.14.21OSV
org.omnifaces:omnifaces, Maven3.14.22OSV
org.omnifaces:omnifaces, Maven3.14.3OSV
org.omnifaces:omnifaces, Maven3.14.4OSV
org.omnifaces:omnifaces, Maven3.14.5OSV
org.omnifaces:omnifaces, Maven3.14.6OSV
org.omnifaces:omnifaces, Maven3.14.7OSV
org.omnifaces:omnifaces, Maven3.14.8OSV
org.omnifaces:omnifaces, Maven3.14.9OSV
org.omnifaces:omnifaces, Maven3.2OSV
org.omnifaces:omnifaces, Maven3.3OSV
org.omnifaces:omnifaces, Maven3.3.1OSV
org.omnifaces:omnifaces, Maven3.4OSV
org.omnifaces:omnifaces, Maven3.4.1OSV
org.omnifaces:omnifaces, Maven3.5OSV
org.omnifaces:omnifaces, Maven3.6OSV
org.omnifaces:omnifaces, Maven3.6.1OSV
org.omnifaces:omnifaces, Maven3.7OSV
org.omnifaces:omnifaces, Maven3.7.1OSV
org.omnifaces:omnifaces, Maven3.8OSV
org.omnifaces:omnifaces, Maven3.8.1OSV
org.omnifaces:omnifaces, Maven3.9OSV
org.omnifaces:omnifaces, Mavenfrom 4.0.0, fixed in 4.7.12OSV
org.omnifaces:omnifaces, Maven4.0OSV
org.omnifaces:omnifaces, Maven4.0.1OSV
org.omnifaces:omnifaces, Maven4.1OSV
org.omnifaces:omnifaces, Maven4.2OSV
org.omnifaces:omnifaces, Maven4.3OSV
org.omnifaces:omnifaces, Maven4.4OSV
org.omnifaces:omnifaces, Maven4.4.1OSV
org.omnifaces:omnifaces, Maven4.5OSV
org.omnifaces:omnifaces, Maven4.5.1OSV
org.omnifaces:omnifaces, Maven4.6OSV
org.omnifaces:omnifaces, Maven4.6.1OSV
org.omnifaces:omnifaces, Maven4.6.2OSV
org.omnifaces:omnifaces, Maven4.6.3OSV
org.omnifaces:omnifaces, Maven4.6.4OSV
org.omnifaces:omnifaces, Maven4.6.5OSV
org.omnifaces:omnifaces, Maven4.7OSV
org.omnifaces:omnifaces, Maven4.7.1OSV
org.omnifaces:omnifaces, Maven4.7.10OSV
org.omnifaces:omnifaces, Maven4.7.11OSV
org.omnifaces:omnifaces, Maven4.7.2OSV
org.omnifaces:omnifaces, Maven4.7.3OSV
org.omnifaces:omnifaces, Maven4.7.4OSV
org.omnifaces:omnifaces, Maven4.7.5OSV
org.omnifaces:omnifaces, Maven4.7.6OSV
org.omnifaces:omnifaces, Maven4.7.7OSV
org.omnifaces:omnifaces, Maven4.7.8OSV
org.omnifaces:omnifaces, Maven4.7.9OSV
org.omnifaces:omnifaces, Mavenfrom 5.0.0, fixed in 5.4.2OSV
org.omnifaces:omnifaces, Maven5.0OSV
org.omnifaces:omnifaces, Maven5.1OSV
org.omnifaces:omnifaces, Maven5.2OSV
org.omnifaces:omnifaces, Maven5.2.1OSV
org.omnifaces:omnifaces, Maven5.2.2OSV
org.omnifaces:omnifaces, Maven5.2.3OSV
org.omnifaces:omnifaces, Maven5.3OSV
org.omnifaces:omnifaces, Maven5.3-M1OSV
org.omnifaces:omnifaces, Maven5.3.1OSV
org.omnifaces:omnifaces, Maven5.3.2OSV
org.omnifaces:omnifaces, Maven5.3.3OSV
org.omnifaces:omnifaces, Maven5.3.4OSV
org.omnifaces:omnifaces, Maven5.4OSV
org.omnifaces:omnifaces, Maven5.4.1OSV

org.omnifaces:omnifaces: OmniFaces: Forged combined-resource IDs and related output/push boundaries

What fixes it

Description

Affected versions 182

References 12