CVE-2026-78384: Apache CXF: Unbounded DEFLATE Decompression in CXF JOSE/JWE and SAML Processing (Decompression Bomb)
Apache CXF can expand a small attacker DEFLATE payload into gigabytes, causing a decompression-bomb denial of service.
Apache disclosed CVE-2026-78384, a moderate decompression-bomb flaw in CXF JOSE/JWE and SAML processing. CompressionUtils.inflate() decompresses attacker-controlled DEFLATE data with no output-size cap, so a payload of about a kilobyte can expand to gigabytes on the heap. It is reachable via JWE decryption when zip=DEF. Affected cxf-core versions are 4.2.0 before 4.2.4, 4.0.0 before 4.1.9, and releases before 3.6.13.
- CompressionUtils.inflate() has no output-size limit on attacker DEFLATE data.
- A kilobyte-scale payload can expand to gigabytes on the heap.
- Reachable through JWE decryption when zip=DEF, and via SAML processing.
- Fixed in CXF 4.2.4, 4.1.9, and 3.6.13.
- CVEs
- CVE-2026-78384
- Vendors
- Apache
- Products
- Apache CXF
- Organizations
- Apache Software Foundation
Vulnerabilities mentioned
All| CVE | Vulnerability | CVSS | EPSS | Signals | Published |
|---|---|---|---|---|---|
| CVE-2026-78384 | Unbounded DEFLATE bomb in Apache CXF JOSE and SAML | 7.5 | — |
From the original article
Posted by Colm O hEigeartaigh on Oct 09 Severity: moderate Affected versions: - Apache CXF (org. apache. cxf:cxf-core) 4.
seclists.org
A short excerpt; the article and its images belong to the publisher. Summary, key facts and assessment above are AI-written from the article and can be wrong.