CVE-2026-102695 OmniFaces: Forged combined-resource IDs and related output/push boundaries

What is CVE-2026-102695?

CVE-2026-102695 is a high-severity vulnerability in omnifaces, published on 14 Oct 2026. An attacker can exploit it over the internet without logging in, with no action from the victim.

Official description

OmniFaces is a utility library for Faces. In OmniFaces versions before 1.14.3, 2.7.33, 3.14.23, 4.7.12, and 5.4.2, CombinedResourceHandler accepts a structurally valid deflated and base64 encoded combined resource ID without verifying that the server issued it. A forged ID can cause unbounded decoded output, add unique reconstructed IDs to a process-lifetime cache, or combine resources other than stylesheets and scripts. Because jakarta.faces.RESOURCE_EXCLUDES is not applied by this custom resolution path, a forged ID can disclose Facelets source from the webapp resource tree or META-INF/resources. In a deployment configured with the wildcard CDN mapping, a forged ID that selects omnifaces.graphic can also cause a blind, deployment-dependent server-side fetch whose destination derives partly from the request Host header. The flaw does not provide arbitrary file read or establish arbitrary-scheme or arbitrary-destination SSRF. The shared authenticity failure permits memory exhaustion and limited resource disclosure. This issue is fixed in versions 1.14.3, 2.7.33, 3.14.23, 4.7.12, and 5.4.2.

Weakness: CWE-552, CWE-409, CWE-345

Which versions are affected by CVE-2026-102695?

10 open source packages ship an affected version, including org.omnifaces:omnifaces.

How do I fix CVE-2026-102695?

Upgrade org.omnifaces:omnifaces to a fixed version for your release line: 1.14.3, 2.7.33, 3.14.23 or 4.7.12.

Is CVE-2026-102695 being exploited?

There is no known exploitation of CVE-2026-102695 in the wild and no public exploit code.

Sources

• CVE record
• NVD
• OSV
• GitHub advisory
• How this page is made

Also known as GHSA-fp43-vj7g-pg92.