Skip to content
VulniPulse
Sign in
Highest advisory severityHigh 2 vendors · 2 advisories

CVE-2026-78384

CVE-2026-78384: 2 tracked advisory records across Apache, Red Hat. Compare vendor sources and published fix guidance.

Compare the source-linked records below. Ratings and product/version details belong to each advisory; they are not a single CVE-wide score or proof that every listed product is affected. How VulniPulse collects and checks evidence.

NVD detail CVE.org

Vendor advisory comparison

Apache

1 advisory
  • Advisory severityUnrated

    Advisory [CVE-2026-78384] CompressionUtils.inflate decompressed attacker-controlled DEFLATE data with no output-size cap

    CVE-2026-78384Source published Source updated

    CompressionUtils.inflate() decompressed attacker-controlled DEFLATE data with no output-size cap. A small (~KB) crafted payload could expand to gigabytes on the heap. Reachable via JWE decryption when zip=DEF (e.g. JoseSessionTokenProvider with RSA-OAEP key wrap) and via SAML redirect/POST binding token inflation — in both cases decompression happens before/independent of trust validation. Fix: Added a configurable maximum inflated-size cap (default 10 MiB, org.apache.cxf.compression-max-inflated-size system property) to CompressionUtils.inflate(); aborts with DataFormatException once exceeded. Users are recommended to upgrade to versions 4.2.4 or 4.1.9 or 3.6.13, which fix this issue.

    Related products — impact not confirmed
    • Apache CXF
    Source-reported affected versions
    • Apache CXF 4.2.0 before 4.2.4
    • Apache CXF 4.0.0 before 4.1.9
    • Apache CXF before 3.6.13
    Source-reported fixed versions
    • 4.2.4
    • 4.1.9
    • 3.6.13
    Mitigation guidance
    • Users are recommended to upgrade to versions 4.2.4 or 4.1.9 or 3.6.13, which fix this issue.
    Full advisory and evidenceOpen source bulletin

Red Hat

1 advisory
  • Advisory severityHigh7.5

    High [CVE-2026-78384] Denial of Service via uncontrolled data decompression

    CVE-2026-78384Source published Source updated

    A flaw was found in Apache CXF. A remote attacker can trigger a Denial of Service (DoS) by submitting specially crafted compressed data during token processing. Because the system decompresses incoming data without enforcing a maximum output size limit, a small payload can consume excessive heap memory. This unchecked expansion can exhaust system resources and crash the service. Red Hat severity: Important — CVSS 7.5 (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H). Weakness: CWE-409. Affected Red Hat products: Red Hat build of Apache Camel 4 for Quarkus 3; Red Hat build of Apache Camel for Spring Boot 4; Red Hat Fuse 7; Red Hat JBoss Enterprise Application Platform 7; Red Hat JBoss Enterprise Application Platform 8; Red Hat JBoss Enterprise Application Platform Expansion Pack; Red Hat…

    Affected products in this advisory
    • Red Hat build of Apache Camel 4 for Quarkus 3
    • Red Hat build of Apache Camel for Spring Boot 4
    • Red Hat Fuse 7
    • Red Hat JBoss Enterprise Application Platform 7

    4 more entries in the full advisory.

    Source-reported affected versions
    Affected-version details not available in this record.
    Source-reported fixed versions
    No fixed-version detail extracted. This does not mean no fix exists.
    Mitigation guidance
    No mitigation guidance extracted; consult the source.
    Full advisory and evidenceOpen source bulletin

Android app · Google Play

Turn CVE research into alerts on your phone.

Choose a whole vendor or a precise platform, then receive matching security advisories by phone notification, email, or both. Coverage follows 34 official vendor sources and 160+ reviewed platform categories.

Matching phone alertsOptional email delivery
Get CVE alertsSee app features