CVE-2026-78384

7.5 HIGH

Published 2026-10-09 · Updated 2026-10-15

AI risk analysis

Summary: The flaw allows attackers to inflate compressed data without size limits, enabling a small payload to expand into gigabytes of heap memory during JWE decryption or SAML token processing. This can lead to memory exhaustion and denial of service.
Exploitability: Exploitation is relatively straightforward as it requires only sending a crafted compressed payload that triggers decompression before trust validation, with no additional prerequisites needed.
Blast radius: The impact could be significant across systems using Apache CXF for JWT or SAML token processing, potentially causing widespread service disruption due to memory exhaustion.
Detection: No reliable host or network indicator is derivable from the published description.
Prioritized remediation: Upgrade to Apache CXF versions 4.2.4, 4.1.9, or 3.6.13 which contain the fix for this compression vulnerability.

denial-of-servicecompressionmemory-exhaustioncxf

Analysis generated locally by garnet-coder (no data left the box). AI-assisted — verify against primary sources before acting.

NVD description

CompressionUtils.inflate() decompressed attacker-controlled DEFLATE data with no output-size cap. A small (~KB) crafted payload could expand to gigabytes on the heap. Reachable via JWE decryption when zip=DEF (e.g. JoseSessionTokenProvider with RSA-OAEP key wrap) and via SAML redirect/POST binding token inflation — in both cases decompression happens before/independent of trust validation. Fix: Added a configurable maximum inflated-size cap (default 10 MiB, org.apache.cxf.compression-max-inflated-size system property) to CompressionUtils.inflate(); aborts with DataFormatException once exceeded. Users are recommended to upgrade to versions 4.2.4 or 4.1.9 or 3.6.13, which fix this issue.

CVSS vector

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

Weaknesses

CWE-409

All references

Source data: NVD (nvd.nist.gov), public domain. Exploit-DB.ai adds local AI analysis for defensive use only.

Related CVEs

Related by shared AI tags and CWE weakness class. Browse the full archive.