Bug 2548458 (CVE-2026-78384) - CVE-2026-78384 org.apache.cxf/cxf-core: Apache CXF: Denial of Service via uncontrolled data decompression
Summary: CVE-2026-78384 org.apache.cxf/cxf-core: Apache CXF: Denial of Service via unc...
Keywords:
Status: NEW
Alias: CVE-2026-78384
Product: Security Response
Classification: Other
Component: vulnerability
Version: unspecified
Hardware: All
OS: Linux
high
high
Target Milestone: ---
Assignee: Product Security
QA Contact:
URL:
Whiteboard:
Depends On:
Blocks:
TreeView+ depends on / blocked
 
Reported: 2026-10-09 10:31 UTC by OSIDB Bzimport
Modified: 2026-10-09 13:56 UTC (History)
45 users (show)

Fixed In Version:
Clone Of:
Environment:
Last Closed:
Embargoed:

Attachments (Terms of Use)

Description OSIDB Bzimport 2026-10-09 10:31:39 UTC 
CompressionUtils.inflate() decompressed attacker-controlled DEFLATE data with no output-size cap. A small (~KB) crafted payload could expand to gigabytes on the heap. Reachable via JWE decryption when zip=DEF (e.g. JoseSessionTokenProvider with RSA-OAEP key wrap) and via SAML redirect/POST binding token inflation — in both cases decompression happens before/independent of trust validation.

Fix: Added a configurable maximum inflated-size cap (default 10 MiB, org.apache.cxf.compression-max-inflated-size system property) to CompressionUtils.inflate(); aborts with DataFormatException once exceeded.
Users are recommended to upgrade to versions 4.2.4 or 4.1.9 or 3.6.13, which fix this issue.
Note You need to log in before you can comment on or make changes to this bug.