{
  "affected": [
    {
      "ranges": [
        {
          "database_specific": {
            "extracted_events": [
              {
                "introduced": "0"
              },
              {
                "fixed": "1.14.3"
              },
              {
                "introduced": "2.0"
              },
              {
                "fixed": "2.7.33"
              },
              {
                "introduced": "3.0"
              },
              {
                "fixed": "3.14.23"
              },
              {
                "introduced": "4.0"
              },
              {
                "fixed": "4.7.12"
              },
              {
                "introduced": "5.0"
              },
              {
                "fixed": "5.4.2"
              }
            ],
            "source": "AFFECTED_FIELD"
          },
          "events": [
            {
              "introduced": "0"
            },
            {
              "fixed": "04fb72e98df2381050c62a5cb5c467b8540e363d"
            },
            {
              "introduced": "cf1dc192d6cf667f8026937aabedf3a5a0b7696b"
            },
            {
              "fixed": "e768480900eeca35ec02c1d51d85588f86331926"
            },
            {
              "introduced": "3a60ffaff87c36bc2426d0c0a1e12fe95150dbef"
            },
            {
              "fixed": "d527fad7dad57f597f4b8828caa839ec693ca3ac"
            },
            {
              "introduced": "4806aaae4df26fe2ff4d9e1fbc0ece785463ece9"
            },
            {
              "fixed": "0ad8b4c645decb8cd6690d67c03b2eddbe6cdc1b"
            },
            {
              "introduced": "7799999debacdb39190bc043ca66341958bd903a"
            },
            {
              "fixed": "7cd869c039c22c8a107547ec118717cd9b68305b"
            }
          ],
          "repo": "https://github.com/omnifaces/omnifaces",
          "type": "GIT"
        }
      ]
    }
  ],
  "aliases": [
    "GHSA-fp43-vj7g-pg92"
  ],
  "database_specific": {
    "cna_assigner": "GitHub_M",
    "cwe_ids": [
      "CWE-345",
      "CWE-409",
      "CWE-552"
    ],
    "osv_generated_from": "https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/102xxx/CVE-2026-102695.json"
  },
  "details": "OmniFaces is a utility library for Faces. In OmniFaces versions before 1.14.3, 2.7.33, 3.14.23, 4.7.12, and 5.4.2, CombinedResourceHandler accepts a structurally valid deflated and base64 encoded combined resource ID without verifying that the server issued it. A forged ID can cause unbounded decoded output, add unique reconstructed IDs to a process-lifetime cache, or combine resources other than stylesheets and scripts. Because jakarta.faces.RESOURCE_EXCLUDES is not applied by this custom resolution path, a forged ID can disclose Facelets source from the webapp resource tree or META-INF/resources. In a deployment configured with the wildcard CDN mapping, a forged ID that selects omnifaces.graphic can also cause a blind, deployment-dependent server-side fetch whose destination derives partly from the request Host header. The flaw does not provide arbitrary file read or establish arbitrary-scheme or arbitrary-destination SSRF. The shared authenticity failure permits memory exhaustion and limited resource disclosure. This issue is fixed in versions 1.14.3, 2.7.33, 3.14.23, 4.7.12, and 5.4.2.",
  "id": "CVE-2026-102695",
  "modified": "2026-10-15T02:30:29.845267750Z",
  "published": "2026-10-14T15:58:43.159Z",
  "references": [
    {
      "type": "ADVISORY",
      "url": "https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/102xxx/CVE-2026-102695.json"
    },
    {
      "type": "FIX",
      "url": "https://github.com/omnifaces/omnifaces/commit/aa42da361821ddfbb85b126564e71587347d2786"
    },
    {
      "type": "WEB",
      "url": "https://github.com/omnifaces/omnifaces/releases/tag/1.14.3"
    },
    {
      "type": "WEB",
      "url": "https://github.com/omnifaces/omnifaces/releases/tag/2.7.33"
    },
    {
      "type": "WEB",
      "url": "https://github.com/omnifaces/omnifaces/releases/tag/3.14.23"
    },
    {
      "type": "WEB",
      "url": "https://github.com/omnifaces/omnifaces/releases/tag/4.7.12"
    },
    {
      "type": "WEB",
      "url": "https://github.com/omnifaces/omnifaces/releases/tag/5.4.2"
    },
    {
      "type": "ADVISORY",
      "url": "https://github.com/omnifaces/omnifaces/security/advisories/GHSA-fp43-vj7g-pg92"
    },
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-102695"
    }
  ],
  "schema_version": "1.9.0",
  "severity": [
    {
      "score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:H",
      "type": "CVSS_V3"
    }
  ],
  "summary": "OmniFaces: Forged combined-resource IDs and related output/push boundaries"
}