AIKIDO-2026-992023
omnifaces is vulnerable to Uncontrolled Resource Consumption
53
Medium Risk
This Affects:
omnifacesTL;DR
The SourceMapResourceHandler keeps a static, unbounded cache keyed by every resource identifier it decorates, including identifiers that have no source map at all. When paired with a resource-synthesizing handler such as CombinedResourceHandler, externally influenced requests for arbitrary resource names cause the cache to grow without eviction or size limit. On long-running deployments this leads to progressive memory pressure and degraded availability. The fix restricts caching to resources that actually have a source map so negative lookups no longer accumulate.
Who does this affect?
You are affected if you are using a version that falls within the vulnerable range and you have the SourceMapResourceHandler registered, typically together with a resource-synthesizing handler such as CombinedResourceHandler.
Background info
omnifaces is vulnerable to Uncontrolled Resource Consumption in versions 3.1.0 - 3.14.22, 4.0.0 - 4.7.11 and 5.0.0 - 5.4.1.
How to fix this
Upgrade the org.omnifaces:omnifaces library to the patch version.
Are You Affected?
Connect your repositories to instantly see whether vulnerable or malicious packages exist in your codebase.
Free. No credit card required.
I consent to receiving marketing communications based on Aikido’s Privacy Policy.
SOC 2Compliant
ISO 27001Compliant