OmniFaces EUVD-2026-101293

Requires the application to register and use OmniFaces CombinedResourceHandler (resource combining), which is an opt-in feature rather than on by every JSF deployment. Given that handler, memory exhaustion and limited Facelets/META-INF/resources source disclosure are reachable by a remote unauthenticated attacker against otherwise default configurations, because jakarta.faces.RESOURCE_EXCLUDES is not applied on this custom resolution path. The additional blind server-side fetch tail is further gated: it requires the non-default wildcard CDN mapping configuration and the omnifaces.graphic inner resource, and its destination derives only partly from the request Host header. Limiting factors: no arbitrary file read, no arbitrary-scheme/arbitrary-destination SSRF, disclosure confined to the webapp resource tree and META-INF/resources, and the whole class is unreachable if CombinedResourceHandler is not in use.

The input CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:H, base 8.2) describes a network-reachable, low-complexity, unauthenticated flaw whose dominant impact is availability (A:H, driven by the ~770:1 decompression amplification causing heap exhaustion) with secondary low confidentiality impact (C:L, limited Facelets source disclosure). CWE-345 (insufficient verification of data authenticity) correctly captures the root cause: the server trusts a structurally valid but unsigned combined-resource ID. No EPSS score, no CISA KEV listing, and no standalone public exploit were provided, so exploitation status is 'no public exploit identified at time of analysis' - though the GHSA advisory contains detailed, reproducible proof-of-concept measurements (20,754 bytes inflating to 16,000,000 characters, ~49 MB heap delta) which materially lowers the barrier to weaponization even without published exploit code. The practical risk is moderated by a configuration dependency the raw CVSS does not reflect: exploitation requires the application to actually register and use OmniFaces CombinedResourceHandler, and the most severe SSRF-flavored tail requires the non-default wildcard CDN mapping. The vendor explicitly disclaims arbitrary file read and arbitrary-scheme/arbitrary-destination SSRF, so the 'SSRF' tag overstates a blind, deployment-dependent server-side fetch. Net assessment: a credible availability/DoS and limited-disclosure priority for JSF/Jakarta Faces applications that use OmniFaces resource combining, but not a wormable, universally-exploitable critical - absence of EPSS/KEV data means widespread active exploitation is not currently evidenced.

A remote, unauthenticated attacker crafts a forged but structurally valid deflated+base64 combined-resource ID and submits it to the OmniFaces CombinedResourceHandler endpoint of a JSF application. Because the ID is never verified as server-issued and decoded output was previously unbounded, the request inflates to tens of megabytes of heap and seeds a permanent cache entry, and forged inner resource identifiers can return raw Facelets (.xhtml) source that RESOURCE_EXCLUDES would normally block. Detailed reproduction measurements exist in the GHSA advisory, but no standalone public exploit code was identified.