# CVE-2026-78384: Apache CXF CompressionUtils.inflate() zip bomb

Source: https://junglewise.ai/threats/cve-2026-78384-compressionutils-inflate-decompressed-attacker-controlled-deflate  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-10-09. Updated: 2026-10-16  
License: CC BY 4.0 with a link back

CVE-2026-78384 · Severity: high · CVSS 7.5 · Published 2026-10-09

Apache CXF's compression utility fails to limit the size of decompressed data, allowing an attacker to send a small compressed file that expands to gigabytes when decompressed. This can cause heap exhaustion and denial of service in applications using CXF for JWE decryption or SAML token processing, where decompression occurs before validation of the data's trustworthiness.

Technologies: [Apache CXF](https://junglewise.ai/threats/technologies/apache-cxf). Vendors: [Apache](https://junglewise.ai/threats/vendors/apache).

## Quick answers

**Is CVE-2026-78384 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2026-78384 being exploited in the wild.

**How severe is CVE-2026-78384?** High severity, with a CVSS score of 7.5, published 9 October 2026.

**Which products and versions are affected?** Apache CXF before 3.6.13, 4.1.x before 4.1.9, 4.2.x before 4.2.4.

**Is there a fix for CVE-2026-78384?** Yes: fixed in CXF 3.6.13, 4.1.9, 4.2.4. Until then: Set the org.apache.cxf.compression-max-inflated-size system property to a lower value if the default 10 MiB cap is too permissive for your use case, or disable compression in JWE and SAML processing if it is not required. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

**How is CVE-2026-78384 attacked?** It is attacked over the network, in a software library.

**Am I affected by CVE-2026-78384?** Check whether you run Apache CXF at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## How to fix

- Fixed in CXF 3.6.13, 4.1.9, 4.2.4

Set the org.apache.cxf.compression-max-inflated-size system property to a lower value if the default 10 MiB cap is too permissive for your use case, or disable compression in JWE and SAML processing if it is not required.

## Technical details

CompressionUtils.inflate() decompresses attacker-controlled DEFLATE data without an output-size limit, enabling zip bomb attacks. The vulnerability is reachable via JWE decryption (with zip=DEF, such as in JoseSessionTokenProvider with RSA-OAEP key wrap) and SAML redirect/POST binding token inflation, where decompression happens before trust validation. The fix adds a configurable maximum inflated-size cap (default 10 MiB) via system property org.apache.cxf.compression-max-inflated-size, aborting with DataFormatException if exceeded.

## Affected products

- Apache CXF before 3.6.13, 4.1.x before 4.1.9, 4.2.x before 4.2.4

## Timeline

- 2026-10-09: disclosed

## References

- [https://repo.maven.apache.org/maven2](https://repo.maven.apache.org/maven2)
- [https://lists.apache.org/thread.html/xoh63rlxn0m9koft5j4jxrfd0hf81v3q](https://lists.apache.org/thread.html/xoh63rlxn0m9koft5j4jxrfd0hf81v3q)

## Related threats

- [Apache CXF hash collision bypass in STS token validation](https://junglewise.ai/threats/cve-2026-97468-apache-cxf-s-ststokenvalidator-and-security-token-service-sts)
- [Apache CXF FIQL query parser ReDoS in operator search](https://junglewise.ai/threats/cve-2026-86463-apache-cxf-s-fiql-query-parser-has-a-vulnerability-in-how-it)
- [Apache CXF OIDC relying-party open redirect after authentication](https://junglewise.ai/threats/cve-2026-79650-apache-cxf-s-oidc-relying-party-component-could-redirect-users-to)
- [Apache CXF race condition in OAuth2 authorization code grant](https://junglewise.ai/threats/cve-2026-73179-improper-enforcement-of-single-use-authorization-code-semantics)
- [Apache CXF StaxUtils XML denial of service](https://junglewise.ai/threats/cve-2026-108039-by-default-staxutils-placed-no-limit-on-the-total-number-of)