Vulnerability in OmniFaces Utility Library Affects Resource Handling
CVE-2026-102695
8.2HIGH
What is CVE-2026-102695?
The OmniFaces utility library has a vulnerability in versions prior to 1.14.3, 2.7.33, 3.14.23, 4.7.12, and 5.4.2 where CombinedResourceHandler accepts forged combined resource IDs. This flaw allows attackers to exploit unbounded decoded outputs, potentially exposing Facelets source code or causing memory exhaustion with limited resource disclosure. Furthermore, a maliciously crafted ID could trigger server-side fetches based on the Host header in configurations using wildcard CDN mapping. This vulnerability emphasizes the need for proper validation in resource handling to ensure security.
Affected Version(s)
omnifaces < 1.14.3 < 1.14.3
omnifaces >= 2.0, < 2.7.33 < 2.0, 2.7.33
omnifaces >= 3.0, < 3.14.23 < 3.0, 3.14.23