CVE-2026-78384: Vulnerability in Apache Software Foundation Apache CXF

The Apache CXF library's CompressionUtils.inflate() function previously decompressed DEFLATE-compressed data without limiting the maximum output size. An attacker can supply a crafted compressed payload that is small in size but expands to gigabytes in memory during decompression, leading to potential denial of service via resource exhaustion. This vulnerability is exploitable through JWE decryption when the compression method is set to DEFLATE (zip=DEF), such as in the JoseSessionTokenProvider with RSA-OAEP key wrap, and also through SAML redirect or POST binding token inflation. The decompression occurs before or independent of any trust validation, increasing risk. The Apache Software Foundation fixed this by introducing a configurable maximum inflated size cap (default 10 MiB) in CompressionUtils.inflate(), which throws a DataFormatException if exceeded. The fix is included in Apache CXF versions 4.2.4, 4.1.9, and 3.6.13.

An attacker can cause excessive memory consumption by sending a small compressed payload that decompresses to a very large size, potentially leading to denial of service conditions such as application crashes or resource exhaustion. This occurs before any trust validation, so malicious payloads can trigger the vulnerability without authentication or authorization.

A fix is available and users are strongly recommended to upgrade to Apache CXF versions 4.2.4, 4.1.9, or 3.6.13 or later. The fix adds a configurable maximum inflated size cap to prevent decompression of excessively large data. No additional mitigation is required if these versions are deployed.