CVE-2026-82904 · Runtime
NO FIX YET · SEE WHAT TO DO
A single small HTTP request to Apache OFBiz can make the server run its service handler up to the signed-integer maximum number of times by encoding a huge row count in parameter names. An unauthenticated remote attacker can tie up request threads and cause denial of service.
first public Nov 5, 2026 · 1 source
Check it with your coding agent
It checks your repository and tells you if you’re affected, with the fix.
Teams running Apache OFBiz 24.09 releases before 24.09.08 on any platform, where the ServiceMultiEventHandler is reachable over HTTP. The description says a stock deployment has no authentication or CSRF requirement on the affected request path, so exposed instances are the main concern. unknown for whether custom deployments change this.
Not affected if not-24.09, patched-24.09.08
Who cares apache-ofbiz, java, self-hosted
24.09.0824.09.08Uncontrolled Resource Consumption in ServiceMultiEventHandler in Apache OFBiz 24.09 before 24.09.08 on all platforms allows a remote unauthenticated attacker to pin a server request thread for an attacker-chosen number of synchronous service dispatches, up to the signed-integer maximum, by submitting a single small HTTP request whose parameter names encode a row count via the "o" suffix used by multi-form submissions, because UtilHttp.getMultiFormRowCount derives that count from the largest such suffix with no upper bound and ServiceMultiEventHandler.invoke then loops that many times calling dispatcher.runSync, with the request-map for getFinAccountTransRunningTotalAndBalances reaching this handler with no authentication or CSRF requirement on a stock deployment. Users are recommended to upgrade to version 24.09.08, which fixes this issue.
NVD data is provided by NIST and is public domain. Posts quoted belong to their authors.
Are you affected?
Tell InfraStack what you run. It checks this one, and every next one, against your stack.
Ask from here. InfraStack checks the affected versions against your stack and answers in your inbox.
InfraStack checks the affected versions against your stack and answers in Slack, with the evidence and the fix.