CVE-2026-41883: OmniFaces EL injection in CDNResourceHandler

CVE-2026-41883 · Severity: high · CVSS 8.1 · Published 2026-05-08

OmniFaces is a utility library used in Java-based web applications to simplify common development tasks. A vulnerability in how the library handles external content delivery networks (CDNs) allows an attacker to execute malicious code on the server. This could lead to a complete system takeover, unauthorized access to sensitive customer data, or service disruptions.

Technologies: OmniFaces. Vendors: Maven, OmniFaces.

Quick answers

Is CVE-2026-41883 exploited in the wild?
No. Junglewise Threat Intelligence has no report of CVE-2026-41883 being exploited in the wild.
How severe is CVE-2026-41883?
High severity, with a CVSS score of 8.1, published 8 May 2026.
Which products and versions are affected?
org.omnifaces:omnifaces (Maven) ECOSYSTEM:introduced=0,fixed=1.14.2; OmniFaces < 1.14.2, < 2.7.32, < 3.14.16, < 4.7.5, < 5.2.3, < 1.14.2, 2.0-RC1 to < 2.7.32, 3.0-RC1 to < 3.14.16, 4.0-M1 to < 4.7.5, 5.0-M1 to < 5.2.3.
Is there a fix for CVE-2026-41883?
Yes. org.omnifaces:omnifaces (Maven): upgrade to 1.14.2 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2026-41883 attacked?
It is attacked over the network, in a software library.
Am I affected by CVE-2026-41883?
Check whether you run org.omnifaces:omnifaces (Maven) or OmniFaces at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

How to fix

  • org.omnifaces:omnifaces (Maven): upgrade to 1.14.2 or later
    # set org.omnifaces:omnifaces to 1.14.2 in your pom.xml or build.gradle

Technical details

A server-side Expression Language (EL) injection vulnerability exists in OmniFaces when using the CDNResourceHandler with wildcard CDN mappings (e.g., libraryName:*=https://cdn.example.com/*). The root cause is the improper neutralization of user-supplied resource names in request URLs, which are subsequently evaluated as EL expressions by the server. An unauthenticated remote attacker can exploit this by crafting a URL containing a malicious EL expression. Depending on the EL implementation and available objects, this can result in Remote Code Execution (RCE), information disclosure, or Denial of Service (DoS). The issue is patched in versions 1.14.2, 2.7.32, 3.14.16, 4.7.5, and 5.2.3; users can also mitigate the risk by replacing wildcard mappings with explicit resource-to-URL mappings.

Affected products

  • OmniFaces OmniFaces < 1.14.2, < 2.7.32, < 3.14.16, < 4.7.5, < 5.2.3

Identifiers

  • CVE-2026-41883
  • GHSA-vp6r-9m58-5xv8

Timeline

  • 2026-04-15: advisory: GitHub Security Advisory published
  • 2026-05-08: disclosed: CVE published to NVD

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.