---
id: CVE-2026-102695
title: OmniFaces is a utility library for Faces
summary: >-
  OmniFaces is a utility library for Faces. In OmniFaces versions before 1.14.3,
  2.7.33, 3.14.23, 4.7.12, and 5.4.2, CombinedResourceHandler accepts a
  structurally valid deflated and base64 encoded combined resource ID without
  verifying th…
severity: high
cvss: 8.2
cvssVector: 'CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:H'
cwe:
  - CWE-345
  - CWE-409
  - CWE-552
  - CWE-79
  - CWE-770
  - CWE-862
vendor: omnifaces
product: 'org.omnifaces:omnifaces'
affected:
  - 'org.omnifaces:omnifaces < 1.14.3'
  - 'org.omnifaces:omnifaces >= 2.0.0, < 2.7.33'
  - 'org.omnifaces:omnifaces >= 3.0.0, < 3.14.23'
  - 'org.omnifaces:omnifaces >= 4.0.0, < 4.7.12'
  - 'org.omnifaces:omnifaces >= 5.0.0, < 5.4.2'
patched:
  - 'org.omnifaces:omnifaces 1.14.3'
  - 'org.omnifaces:omnifaces 2.7.33'
  - 'org.omnifaces:omnifaces 3.14.23'
  - 'org.omnifaces:omnifaces 4.7.12'
  - 'org.omnifaces:omnifaces 5.4.2'
published: '2026-10-14'
updated: '2026-10-14'
sourceUpdated: '2026-10-14T16:17:29.840'
source: NVD
sourceUrl: 'https://nvd.nist.gov/vuln/detail/CVE-2026-102695'
references:
  - url: >-
      https://github.com/omnifaces/omnifaces/commit/aa42da361821ddfbb85b126564e71587347d2786
    label: security-advisories@github.com
  - url: 'https://github.com/omnifaces/omnifaces/releases/tag/1.14.3'
    label: security-advisories@github.com
  - url: 'https://github.com/omnifaces/omnifaces/releases/tag/2.7.33'
    label: security-advisories@github.com
  - url: 'https://github.com/omnifaces/omnifaces/releases/tag/3.14.23'
    label: security-advisories@github.com
  - url: 'https://github.com/omnifaces/omnifaces/releases/tag/4.7.12'
    label: security-advisories@github.com
  - url: 'https://github.com/omnifaces/omnifaces/releases/tag/5.4.2'
    label: security-advisories@github.com
  - url: >-
      https://github.com/omnifaces/omnifaces/security/advisories/GHSA-fp43-vj7g-pg92
    label: security-advisories@github.com
  - url: >-
      https://github.com/omnifaces/omnifaces/commit/59d6c5188c39418546fe500d05036645987a77d1
  - url: >-
      https://github.com/omnifaces/omnifaces/commit/a52b92461cf39d983f51ce8724fe7e6b944073e4
  - url: >-
      https://github.com/omnifaces/omnifaces/commit/c43eef01174a4dc09cec44eff553ff6284150af7
  - url: >-
      https://github.com/omnifaces/omnifaces/commit/d5cae243c4692555efaa4ba774e0f8f60e3f4db5
  - url: 'https://github.com/advisories/GHSA-fp43-vj7g-pg92'
tags:
  - nvd
  - ghsa
  - maven
aliases:
  - GHSA-fp43-vj7g-pg92
ecosystem: maven
scores:
  nvd: 8.2
  ghsa: 7.5
ingestedAt: '2026-10-14T16:40:32.111Z'
---

## Overview

OmniFaces is a utility library for Faces. In OmniFaces versions before 1.14.3, 2.7.33, 3.14.23, 4.7.12, and 5.4.2, CombinedResourceHandler accepts a structurally valid deflated and base64 encoded combined resource ID without verifying that the server issued it. A forged ID can cause unbounded decoded output, add unique reconstructed IDs to a process-lifetime cache, or combine resources other than stylesheets and scripts. Because jakarta.faces.RESOURCE_EXCLUDES is not applied by this custom resolution path, a forged ID can disclose Facelets source from the webapp resource tree or META-INF/resources. In a deployment configured with the wildcard CDN mapping, a forged ID that selects omnifaces.graphic can also cause a blind, deployment-dependent server-side fetch whose destination derives partly from the request Host header. The flaw does not provide arbitrary file read or establish arbitrary-scheme or arbitrary-destination SSRF. The shared authenticity failure permits memory exhaustion and limited resource disclosure. This issue is fixed in versions 1.14.3, 2.7.33, 3.14.23, 4.7.12, and 5.4.2.

## Remediation

Refer to the linked advisories for vendor-supplied fixes and affected version ranges.

## Package advisory (CVE-2026-102695)

Affected packages:

- `org.omnifaces:omnifaces < 1.14.3`
- `org.omnifaces:omnifaces >= 2.0.0, < 2.7.33`
- `org.omnifaces:omnifaces >= 3.0.0, < 3.14.23`
- `org.omnifaces:omnifaces >= 4.0.0, < 4.7.12`
- `org.omnifaces:omnifaces >= 5.0.0, < 5.4.2`

Patched in:

- `org.omnifaces:omnifaces 1.14.3`
- `org.omnifaces:omnifaces 2.7.33`
- `org.omnifaces:omnifaces 3.14.23`
- `org.omnifaces:omnifaces 4.7.12`
- `org.omnifaces:omnifaces 5.4.2`

Source: https://github.com/advisories/GHSA-fp43-vj7g-pg92