CVE-2026-78384

Katalog CVE

CVSS 7.5 · High EPSS 0,16%

Kerentanan Improper Handling of Highly Compressed Data (Data Amplification). Skor CVSS 3.1 7.5 (High) menurut CISA ADP.

Deskripsi (NVD)

CompressionUtils.inflate() decompressed attacker-controlled DEFLATE data with no output-size cap. A small (~KB) crafted payload could expand to gigabytes on the heap. Reachable via JWE decryption when zip=DEF (e.g. JoseSessionTokenProvider with RSA-OAEP key wrap) and via SAML redirect/POST binding token inflation — in both cases decompression happens before/independent of trust validation. Fix: Added a configurable maximum inflated-size cap (default 10 MiB, org.apache.cxf.compression-max-inflated-size system property) to CompressionUtils.inflate(); aborts with DataFormatException once exceeded. Users are recommended to upgrade to versions 4.2.4 or 4.1.9 or 3.6.13, which fix this issue.

Rincian

Terbit di NVD

9 Oktober 2026

Terakhir diubah

15 Oktober 2026

Status NVD

Undergoing Analysis

CVSS 3.1

7.5 (High), sumber CISA ADP
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N · uraikan di kalkulator

Jenis kelemahan (CWE)

CWE-409: Improper Handling of Highly Compressed Data (Data Amplification)

EPSS (30 hari)

0,16% peluang dieksploitasi; lebih tinggi dari 4,5% CVE lain

Produk dan versi terdampak

NVD belum mencantumkan data produk (CPE) untuk CVE ini. Produk yang terdampak biasanya disebut di deskripsi dan di advisory vendor pada daftar referensi.

Referensi dan perbaikan

• https://lists.apache.org/thread.html/xoh63rlxn0m9koft5j4jxrfd0hf81v3q
• http://www.openwall.com/lists/oss-security/2026/10/09/6