The vulnerability resides in the CombinedResourceHandler component of OmniFaces. It accepts a structurally valid but potentially forged, deflated and base64 encoded combined resource ID without verifying that it was issued by the server. Attackers can craft such IDs. A forged ID can produce unbounded decoded output, add unique reconstructed IDs to the process‑lifetime cache, or combine resources other than stylesheets and scripts. Because the custom resolution path bypasses jakarta.faces.RESOURCE_EXCLUDES, it can disclose Facelets source files from the webapp resource tree or META‑INF/resources. The flaw does not allow arbitrary file read or arbitrary‑scheme SSRF but permits limited resource disclosure and induced memory exhaustion via unbounded decoding. The overall impact is a security boundary breach leading to potential partial data leakage and a denial‑of‑service condition due to excessive memory use.

Affected vendors and products are OmniFaces, version 1.x releases prior to 1.14.3; 2.x releases prior to 2.7.33; 3.x releases prior to 3.14.23; 4.x releases prior to 4.7.12; and 5.x releases prior to 5.4.2. All these versions run the legacy CombinedResourceHandler which is responsible for concatenating JS and CSS files. Administrators using any of these releases should check their module version.

The CVSS base score of 8.2 indicates high severity. The EPSS score of 0.00306 indicates a very low probability of exploitation, though the flaw is still exploitable. The vulnerability is not listed in CISA's KEV catalog, implying no verified exploitation has been reported publicly. Based on the description, it is inferred that an attacker could trigger the flaw by sending a crafted HTTP request containing a forged combined resource ID. Because the vulnerability does not require elevated privileges, any application user with access to the web interface can potentially trigger it. The flaw can be exploited remotely via the web application, with the risk of memory exhaustion and limited data disclosure. No direct arbitrary read or SSRF is possible, but the resource leakage could expose internal source files and the production environment might suffer from degraded performance or denial of service.