CVE-2026-82904High· 7.5▾ TwilightUncontrolled Resource Consumption in ServiceMultiEventHandler in Apache OFBiz 24.09 before 24.09.08 on all platforms allows a remote unauthenticated attacker to pin a server request thread for an attacker-chosen number of synchronous ser…
▾ Twilight zone — High severity, or a signal on a lesser flaw
impact 41.3 · likelihood 0 · exploitation 0
Need a working PoC? Pro members can cast a request and our team develops one — it lands right here.
Stakeholder-Specific Vulnerability Categorization from CISA's ADP record at CVE.org: whether exploitation is observed, whether an attack can be automated, and how much of the system is at stake. The CVSS score shown above comes from the CISA ADP record, not NVD.
Uncontrolled Resource Consumption in ServiceMultiEventHandler in Apache OFBiz 24.09 before 24.09.08 on all platforms allows a remote unauthenticated attacker to pin a server request thread for an attacker-chosen number of synchronous service dispatches, up to the signed-integer maximum, by submitting a single small HTTP request whose parameter names encode a row count via the "o" suffix used by multi-form submissions, because UtilHttp.getMultiFormRowCount derives that count from the largest such suffix with no upper bound and ServiceMultiEventHandler.invoke then loops that many times calling dispatcher.runSync, with the request-map for getFinAccountTransRunningTotalAndBalances reaching this handler with no authentication or CSRF requirement on a stock deployment. Users are recommended to upgrade to version 24.09.08, which fixes this issue.
apache_ofbiz < 24.09.08Refer to the linked advisories for vendor-supplied fixes and affected version ranges.
Connected by shared product, vendor, weakness, or advisory.
CVE-2026-82916High· 7.1Apache OFBiz: webtools xmldsdump exports any entity to any path
CVE-2026-82902Medium· 4.3Apache OFBiz: Unfiltered server-side URL fetch in webtools viewdatafile
CVE-2026-81734NoneApache OFBiz: Missing authorization - catalog quick-admin product writes
CVE-2026-74841NoneApache OFBiz: Denial of Service via unauthenticated userTenantId in multitenant mode
CVE-2026-76152NoneApache OFBiz: Authenticated path traversal and missing authorization check in imageCrop and imageRotate services
CVE-2026-73580NoneApache OFBiz: Unauthenticated HR organization and employee disclosure