CVE-2026-102695

OmniFaces is a utility library for Faces. In OmniFaces versions before 1.14.3, 2.7.33, 3.14.23, 4.7.12, and 5.4.2, CombinedResourceHandler accepts a structurally valid deflated and base64 encoded combined resource ID without verifying that the server issued it. A forged ID can cause unbounded...

CVE-2026-102695 OmniFaces: Forged combined-resource IDs and related output/push boundaries

OmniFaces is a utility library for Faces. In OmniFaces versions before 1.14.3, 2.7.33, 3.14.23, 4.7.12, and 5.4.2, CombinedResourceHandler accepts a structurally valid deflated and base64 encoded combined resource ID without verifying that the server issued it. A forged ID can cause unbounded...

CVE-2026-102695

OmniFaces is a utility library for Faces. In OmniFaces versions before 1.14.3, 2.7.33, 3.14.23, 4.7.12, and 5.4.2, CombinedResourceHandler accepts a structurally valid deflated and base64 encoded combined resource ID without verifying that the server issued it. A forged ID can cause unbounded...

CVE-2026-102695 OmniFaces: Forged combined-resource IDs and related output/push boundaries

OmniFaces is a utility library for Faces. In OmniFaces versions before 1.14.3, 2.7.33, 3.14.23, 4.7.12, and 5.4.2, CombinedResourceHandler accepts a structurally valid deflated and base64 encoded combined resource ID without verifying that the server issued it. A forged ID can cause unbounded...

CVE-2026-102695 OmniFaces: Forged combined-resource IDs and related output/push boundaries

OmniFaces is a utility library for Faces. In OmniFaces versions before 1.14.3, 2.7.33, 3.14.23, 4.7.12, and 5.4.2, CombinedResourceHandler accepts a structurally valid deflated and base64 encoded combined resource ID without verifying that the server issued it. A forged ID can cause unbounded...

EUVD-2026-101293

OmniFaces is a utility library for Faces. In OmniFaces versions before 1.14.3, 2.7.33, 3.14.23, 4.7.12, and 5.4.2, CombinedResourceHandler accepts a structurally valid deflated and base64 encoded combined resource ID without verifying that the server issued it. A forged ID can cause unbounded...

CVE-2026-102695

The OmniFaces utility library (versions before 1.14.3, 2.7.33, 3.14.23, 4.7.12, and 5.4.2) contains a vulnerability in CombinedResourceHandler because it accepts structurally valid deflated and base64 encoded combined resource IDs without verifying server issuance. This shared authenticity failur...

CVE-2026-102695: Insufficient Verification of Data Authenticity

OmniFaces is a utility library for Faces. In OmniFaces versions before 1.14.3, 2.7.33, 3.14.23, 4.7.12, and 5.4.2, CombinedResourceHandler accepts a structurally valid deflated and base64 encoded combined resource ID without verifying that the server issued it. A forged ID can cause unbounded...

io.quarkiverse.omnifaces:quarkus-omnifaces (>=4.6.2, <=5.5.1), io.quarkiverse.omnifaces:quarkus-omnifaces-deployment (>=4.6.2, <=5.5.1) +25 more potentially affected by CVE-2026-76646 via org.apache.myfaces.core:myfaces-impl (>=4.1.0, <=4.1.3)

org.apache.myfaces.core:myfaces-impl MAVEN version =4.1.0, =4.6.2, =4.6.2, =3.15.0, =3.15.0, =3.15.0, =3.15.0, =4.1.0, =4.1.0, =4.1.0, =4.1.0, =4.1.3 - org.apache.tomee.bom:tomee-webprofile 11.0.0-m1 - org.apache.tomee.maven:tomee-embedded-maven-plugin 11.0.0-m1 - org.apache.tomee:apache-tomee...

com.github.adminfaces:quarkus-omnifaces (>=1.1.0, <=1.4.0), com.github.adminfaces:quarkus-omnifaces-deployment (>=1.1.0, <=1.4.0) +15 more potentially affected by CVE-2026-76646 via org.apache.myfaces.core:myfaces-impl (>=2.3-next-m1, <=2.3-next-m8)

org.apache.myfaces.core:myfaces-impl MAVEN version =2.3-next-m1, =1.1.0, =1.1.0, =3.0.0, =3.0.0, =3.0.0, =2.12.0, =2.12.0, =2.12.0, =2.12.0, =2.12.0, =2.3-next-m3, =2.3-next-m1, =2.3-next-m1, =2.3-next-m1, =2.3-next-m8 and more Source cves: CVE-2026-76646 Sou...

com.github.adminfaces:quarkus-omnifaces (>=1.1.0, <=1.4.0), com.github.adminfaces:quarkus-omnifaces-deployment (>=1.1.0, <=1.4.0) +15 more potentially affected by CVE-2026-68536 via org.apache.myfaces.core:myfaces-impl (>=2.3-next-m1, <=2.3-next-m8)

org.apache.myfaces.core:myfaces-impl MAVEN version =2.3-next-m1, =1.1.0, =1.1.0, =3.0.0, =3.0.0, =3.0.0, =2.12.0, =2.12.0, =2.12.0, =2.12.0, =2.12.0, =2.3-next-m3, =2.3-next-m1, =2.3-next-m1, =2.3-next-m1, =2.3-next-m8 and more Source cves: CVE-2026-68536 Sou...

cloud.piranha.extension:piranha-extension-myfaces (>=22.9.0, <=22.10.0), cloud.piranha:debug (>=22.9.0, <=22.10.0) +56 more potentially affected by CVE-2026-68536 via org.apache.myfaces.core:myfaces-impl (>=4.0.0-rc1, <=4.0.3)

org.apache.myfaces.core:myfaces-impl MAVEN version =4.0.0-rc1, =22.9.0, =22.9.0, =13.0.10.liferay-patched-1, =4.1.0, =4.1.0, =4.1.0, =4.5.1 and more Source cves: CVE-2026-68536 Source advisory: MEND:CVE-2026-68536...

io.quarkiverse.omnifaces:quarkus-omnifaces (>=4.6.0, <=5.5.1), io.quarkiverse.omnifaces:quarkus-omnifaces-deployment (>=4.6.0, <=5.5.1) +25 more potentially affected by CVE-2026-68536 via org.apache.myfaces.core:myfaces-impl (>=4.1.0-rc1, <=4.1.3)

org.apache.myfaces.core:myfaces-impl MAVEN version =4.1.0-rc1, =4.6.0, =4.6.0, =3.14.7, =3.14.7, =3.14.7, =3.14.7, =4.1.0-rc1, =4.1.0-rc1, =4.1.0-rc1, =4.1.0-rc1, =4.1.3 - org.apache.tomee.bom:tomee-webprofile 11.0.0-m1 - org.apache.tomee.maven:tomee-embedded-maven-plugin 11.0.0-m1 -...

com.github.adminfaces:quarkus-omnifaces (1.4.0), com.github.adminfaces:quarkus-omnifaces-deployment (1.4.0) +120 more potentially affected by CVE-2026-50559 via io.quarkus:quarkus-vertx-http (1.13.5.final)

io.quarkus:quarkus-vertx-http MAVEN version 1.13.5.final is affected by a known vulnerability. The following packages have a transitive dependency on io.quarkus:quarkus-vertx-http and may be impacted: - com.github.adminfaces:quarkus-omnifaces 1.4.0 -...

co.luminositylabs.oss.ica.migration:legacy-data-viewer-webapp (0.2.0), com.aripd:aricom (1.0) +13 more potentially affected by CVE-2026-102695 +1 more via org.omnifaces:omnifaces (>=2.0, <=2.7.1)

org.omnifaces:omnifaces MAVEN version =2.0, =2.0.4, =2.0.4, =2.0.4, =2.0.4, =2.0.4, =1.0.0-rc1, =1.0.0-rc1, =0.1, =0.14 Source cves: CVE-2026-102695, CVE-2026-41883 Source advisory: GHSA-FP43-VJ7G-PG92...

com.flowlogix.depchain:shiro-jakarta (>=18, <=100), com.flowlogix:jee-examples (>=6.0, <=9.0.3) +40 more potentially affected by CVE-2026-102695 via org.omnifaces:omnifaces (>=4.0, <=4.7.10)

org.omnifaces:omnifaces MAVEN version =4.0, =18, =6.0, =7.0.0-pre-release, =7.0.0-pre-release, =7.0.0-pre-release, =7.0.0-pre-release, =7.0.0-pre-release, =7.0.0-pre-release, =7.0.0-pre-release, =7.0.0-m3, =7.0.0-m2, =7.0.0-m2, =7.0.0-m1, =7.0.0-m1, =7.0.0-m7 and more Source cves: CVE-2026-102695...

com.flowlogix.depchain:shiro-jakarta (>=18, <=100), com.flowlogix:jee-examples (>=6.0, <=9.0.3) +40 more potentially affected by CVE-2026-102695 +1 more via org.omnifaces:omnifaces (>=4.0, <=4.7.10)

org.omnifaces:omnifaces MAVEN version =4.0, =18, =6.0, =7.0.0-pre-release, =7.0.0-pre-release, =7.0.0-pre-release, =7.0.0-pre-release, =7.0.0-pre-release, =7.0.0-pre-release, =7.0.0-pre-release, =7.0.0-m3, =7.0.0-m2, =7.0.0-m2, =7.0.0-m1, =7.0.0-m1, =7.0.0-m7 and more Source cves: CVE-2026-102695...

com.flowlogix.depchain:shiro-jakarta (>=105, <=128), de.muehlencord.pf-adm:pf-adm-spring-boot-autoconfigure (>=0.2.0, <=0.4.1) +10 more potentially affected by CVE-2026-102695 +1 more via org.omnifaces:omnifaces (>=5.0, <=5.4.1)

org.omnifaces:omnifaces MAVEN version =5.0, =105, =0.2.0, =0.2.0, =0.2.0, =1.6.0, =5.0, =5.0, =4.21.0, =4.21.0, =3.0.0-alpha-1, =6.0.2, =6.0.2, =6.1.0 Source cves: CVE-2026-102695, CVE-2026-41883 Source advisory: GHSA-FP43-VJ7G-PG92...

Missing Authorization

Overview Affected versions of this package are vulnerable to Missing Authorization via the CombinedResourceInfo process. An attacker can cause excessive memory consumption and potentially exhaust server resources by submitting forged combined-resource IDs that inflate to large outputs and are...

com.flowlogix.depchain:shiro-jakarta (>=101, <=128), de.muehlencord.pf-adm:pf-adm-spring-boot-autoconfigure (>=0.2.0, <=0.4.1) +10 more potentially affected by unknown CVE via org.omnifaces:omnifaces (>=5.0-m2, <=5.4.1)

org.omnifaces:omnifaces MAVEN version =5.0-m2, =101, =0.2.0, =0.2.0, =0.2.0, =1.6.0, =5.0-m2, =5.0-m2, =4.21.0, =4.21.0, =3.0.0-alpha-1, =6.0.2, =6.0.2, =6.1.0 Source cves: unknown CVE Source advisory: SNYK:JAVA-ORGOMNIFACES-18313155...