{"id":"CVE-2026-78384","published":"2026-10-09T11:17:02.937","lastModified":"2026-10-15T17:17:28.340","description":"CompressionUtils.inflate() decompressed attacker-controlled DEFLATE data with no output-size cap. A small (~KB) crafted payload could expand to gigabytes on the heap. Reachable via JWE decryption when zip=DEF (e.g. JoseSessionTokenProvider with RSA-OAEP key wrap) and via SAML redirect/POST binding token inflation — in both cases decompression happens before/independent of trust validation.\n\nFix: Added a configurable maximum inflated-size cap (default 10 MiB, org.apache.cxf.compression-max-inflated-size system property) to CompressionUtils.inflate(); aborts with DataFormatException once exceeded.\nUsers are recommended to upgrade to versions 4.2.4 or 4.1.9 or 3.6.13, which fix this issue.","cvssScore":7.5,"cvssSeverity":"HIGH","cvssVector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N","cwes":["CWE-409"],"vendors":[],"products":[],"references":[{"url":"https://lists.apache.org/thread.html/xoh63rlxn0m9koft5j4jxrfd0hf81v3q","tags":[]},{"url":"http://www.openwall.com/lists/oss-security/2026/10/09/6","tags":[]}],"exploitRefs":[],"hasPoc":false,"ai":{"summary":"The flaw allows attackers to inflate compressed data without size limits, enabling a small payload to expand into gigabytes of heap memory during JWE decryption or SAML token processing. This can lead to memory exhaustion and denial of service.","exploitability":"Exploitation is relatively straightforward as it requires only sending a crafted compressed payload that triggers decompression before trust validation, with no additional prerequisites needed.","blast_radius":"The impact could be significant across systems using Apache CXF for JWT or SAML token processing, potentially causing widespread service disruption due to memory exhaustion.","remediation":"Upgrade to Apache CXF versions 4.2.4, 4.1.9, or 3.6.13 which contain the fix for this compression vulnerability.","detection":"No reliable host or network indicator is derivable from the published description.","tags":["denial-of-service","compression","memory-exhaustion","cxf"],"model":"garnet-coder","analyzedAt":"2026-10-17T09:02:27.673Z"}}