Patch Forecast
Yellow warning
Plan into this sprint.

CVE-2026-78384

CompressionUtils.inflate() decompressed attacker-controlled DEFLATE data with no output-size cap

Risk score
56/100
CVSS
7.5 v3.1
Exploit chance (30 days)
0.4%
Published
9 Oct 2026

Open in the live forecast Today's forecast

What to know

What it is
CompressionUtils.inflate() decompressed attacker-controlled DEFLATE data with no output-size cap. A small (~KB) crafted payload could expand to gigabytes on the heap. Reachable via JWE decryption when zip=DEF (e.g. JoseSessionTokenProvider with RSA-OAEP key wrap) and via SAML redirect/POST binding token inflation — in…
Affected
Apache Cxf before 4.2.4, 4.1.9, 3.6.13
Fix
Upgrade Apache Cxf to 4.2.4, 4.1.9 or 3.6.13 (whichever matches your release line), or later.
Exploitation
No known exploitation

Story map

Story map: Apache CxfTHE FLAWSTHE FIXCVE-2026-78384CompressionUtils.inflate()decompressedattacker-controlled DEFLATE…CVSS 7.5 · EPSS 0%CVE-2026-71575The max_ageauthentication-freshnesscheck in…CVSS 9.1 · EPSS 0%CVE-2026-97468Apache CXF'sSTSTokenValidator andSecurity Token Service (STS)…CVSS 9.1 · EPSS 0%CVE-2026-107938In Apache CXF, theNetty-based HTTP clienttransport…CVSS 9.1 · EPSS 0%Upgrade Apache Cxf4.2.4 · 4.1.9 · 3.6.13or later on your release lineWho is exposedApache Cxf before 4.2.4, 4.1.9,3.6.13AMBER · PATCH THIS WEEKApache CxfThe max_ageauthentication-freshness checkin OidcClientCodeRequestFilterwas inoperative due to amilliseconds/seconds unitmismatch and an invertedcomparison polarity. Any…Where it standsNo known exploitationCONNECTS TOSame weaknessCWE-409 (CWE-409)35 other warnings in 30 days →Same productEarlier Apache Cxf warnings7 in the last 90 days →
Story map: the flaws, the fix, how it unfolded and what it connects to. Boxes link to the record or article.

At a glance

Apache Cxf: Amber, patch this week. The max_age authentication-freshness check in OidcClientCodeRequestFilter was inoperative due to a milliseconds/seconds unit mismatch and an inverted comparison polarity. Any relying party using setMaxAgeOffset to enforce re-authentication would silently accept sessions of any age, bypassing step-up authentication pol…

The flaws

  • CVE-2026-78384: CompressionUtils.inflate() decompressed attacker-controlled DEFLATE data with no output-size cap (CVSS 7.5 · EPSS 0%)
  • CVE-2026-71575: The max_age authentication-freshness check in OidcClientCodeRequestFilter was inoperative due to a… (CVSS 9.1 · EPSS 0%)
  • CVE-2026-97468: Apache CXF's STSTokenValidator and Security Token Service (STS) cached validated security tokens… (CVSS 9.1 · EPSS 0%)
  • CVE-2026-107938: In Apache CXF, the Netty-based HTTP client transport (cxf-rt-transports-http-netty-client) did not… (CVSS 9.1 · EPSS 0%)

The fix

Upgrade Apache Cxf: 4.2.4 · 4.1.9 · 3.6.13 or later on your release line

Who is exposed: Apache Cxf before 4.2.4, 4.1.9, 3.6.13

Where it stands

  • No known exploitation

Connects to

Why it is Yellow

  • CVSS 7.5 high
  • Remotely exploitable without logging in

References

Original description

CompressionUtils.inflate() decompressed attacker-controlled DEFLATE data with no output-size cap. A small (~KB) crafted payload could expand to gigabytes on the heap. Reachable via JWE decryption when zip=DEF (e.g. JoseSessionTokenProvider with RSA-OAEP key wrap) and via SAML redirect/POST binding token inflation — in both cases decompression happens before/independent of trust validation. Fix: Added a configurable maximum inflated-size cap (default 10 MiB, org.apache.cxf.compression-max-inflated-size system property) to CompressionUtils.inflate(); aborts with DataFormatException once exceeded. Users are recommended to upgrade to versions 4.2.4 or 4.1.9 or 3.6.13, which fix this issue.

Last activity 9 Oct 2026. Patch Forecast updates every hour.