CVE-2026-78384: Apache CXF: Unbounded DEFLATE Decompression in CXF JOSE/JWE and SAML Processing (Decompression Bomb)

As cited

Copy frozen at 2026-10-09 13:24 UTC (site build).

vulnerabilities

CVE-2026-78384: Apache CXF: Unbounded DEFLATE Decompression in CXF JOSE/JWE and SAML Processing (Decompression Bomb)

Apache CXF versions before 3.6.13, 4.1.9, and 4.2.4 contain an unbounded decompression vulnerability in CompressionUtils.inflate() that processes attacker-controlled DEFLATE data without output-size limits. A small crafted payload can expand to gigabytes on the heap when decompressed during JWE decryption or SAML processing, potentially causing denial of service.

Why it matters: Organizations running Apache CXF in production with JWE or SAML token processing face denial of service risk from unauthenticated attackers sending compressed payloads; immediate patching to the fixed versions is required.

Source published

2026-10-09 10:15 UTC

First seen by Cybersecurity Tracker

2026-10-09 11:33 UTC