{"id":"CVE-2026-82904","kind":"vulnerability","aliases":["CVE-2026-82904"],"related":[],"title":"Apache OFBiz: unauthenticated request can pin server threads with huge loops","description":"Uncontrolled Resource Consumption in ServiceMultiEventHandler in Apache OFBiz 24.09 before 24.09.08 on all platforms allows a remote unauthenticated attacker to pin a server request thread for an attacker-chosen number of synchronous service dispatches, up to the signed-integer maximum, by submitting a single small HTTP request whose parameter names encode a row count via the \"o\" suffix used by multi-form submissions, because UtilHttp.getMultiFormRowCount derives that count from the largest such suffix with no upper bound and ServiceMultiEventHandler.invoke then loops that many times calling dispatcher.runSync, with the request-map for getFinAccountTransRunningTotalAndBalances reaching this handler with no authentication or CSRF requirement on a stock deployment. Users are recommended to upgrade to version 24.09.08, which fixes this issue.","summary":"A single small HTTP request to Apache OFBiz can make the server run its service handler up to the signed-integer maximum number of times by encoding a huge row count in parameter names. An unauthenticated remote attacker can tie up request threads and cause denial of service.","severity":"high","cvss":null,"epss":null,"exploited":false,"exploited_at":null,"products":[],"ecosystems":[],"tags":["apache-ofbiz","java","runtime","self-hosted"],"not_affected_if":["not-24.09","patched-24.09.08"],"how_to_check":"- Check the installed OFBiz version; affected versions are 24.09 before `24.09.08`\n- Confirm whether the deployment is a stock configuration reachable from the internet, since the description says no authentication or CSRF requirement applies on a stock deployment","fix":"- Apache OFBiz: upgrade to `24.09.08`","status":"open","published_at":"2026-11-05T14:17:05+00:00","first_seen_at":"2026-11-05T14:39:18+00:00","triaged_at":"2026-11-05T14:40:43+00:00","updated_at":"2026-11-05T14:40:43+00:00","category":"runtime","confidence":0.7,"triage":{"at":"2026-11-05T14:40:43Z","model":"claude-haiku-5-5","output":{"fix":"- Apache OFBiz: upgrade to `24.09.08`","reach":"internet","title":"Apache OFBiz: unauthenticated request can pin server threads with huge loops","impact":"low","summary":"A single small HTTP request to Apache OFBiz can make the server run its service handler up to the signed-integer maximum number of times by encoding a huge row count in parameter names. An unauthenticated remote attacker can tie up request threads and cause denial of service.","audience":"businesses","category":"runtime","nicknames":[],"who_cares":["apache-ofbiz","java","self-hosted"],"confidence":0.7,"fix_status":"available","needs_auth":"no","worst_case":"server request threads pinned, causing denial of service","analyst_note":"","how_to_check":"- Check the installed OFBiz version; affected versions are 24.09 before `24.09.08`\n- Confirm whether the deployment is a stock configuration reachable from the internet, since the description says no authentication or CSRF requirement applies on a stock deployment","plain_action":"","needs_analyst":false,"not_affected_if":["not-24.09","patched-24.09.08"],"who_is_affected":"Teams running Apache OFBiz 24.09 releases before 24.09.08 on any platform, where the ServiceMultiEventHandler is reachable over HTTP. The description says a stock deployment has no authentication or CSRF requirement on the affected request path, so exposed instances are the main concern. unknown for whether custom deployments change this.","user_interaction":"no","needs_special_setup":"unknown","severity_if_unknown":"high"},"cost_usd":0.00072,"input_tokens":4436,"output_tokens":553,"severity_before":"unknown"},"analyst_status":null,"analyst_note":null,"search":"'-2026':13A,16A '-82904':14A,17A '24.09':83C '24.09.08':85C,191C 'allow':89C 'apach':1A,19B,32B,81C 'apache-ofbiz':18B 'attack':64B,93C,103C 'attacker-chosen':102C 'authent':176C 'bound':154C 'call':162C 'caus':71B 'chosen':104C 'consumpt':77C 'count':57B,130C,145C 'csrf':178C 'cve':12A,15A 'denial':72B 'deploy':183C 'deriv':143C 'dispatch':109C 'dispatcher.runsync':163C 'encod':53B,127C 'fix':193C 'form':139C 'getfinaccounttransrunningtotalandbal':170C 'handler':41B,173C 'host':25B 'http':29B,122C 'huge':10A,55B 'integ':47B,115C 'issu':195C 'java':21B 'largest':148C 'loop':11A,158C 'make':35B 'mani':160C 'map':168C 'maximum':48B,116C 'multi':138C 'multi-form':137C 'name':60B,126C 'number':49B,105C 'o':133C 'ofbiz':2A,20B,33B,82C 'paramet':59B,125C 'pin':6A,95C 'platform':88C 'reach':171C 'recommend':186C 'remot':63B,91C 'request':4A,30B,68B,98C,123C,167C 'request-map':166C 'requir':179C 'resourc':76C 'row':56B,129C 'run':38B 'runtim':22B 'self':24B 'self-host':23B 'server':7A,37B,97C 'servic':40B,74B,108C 'servicemultieventhandl':79C 'servicemultieventhandler.invoke':156C 'sign':46B,114C 'signed-integ':45B,113C 'singl':27B,120C 'small':28B,121C 'stock':182C 'submiss':140C 'submit':118C 'suffix':134C,150C 'synchron':107C 'thread':8A,69B,99C 'tie':66B 'time':51B,161C 'unauthent':3A,62B,92C 'uncontrol':75C 'upgrad':188C 'upper':153C 'use':135C 'user':184C 'utilhttp.getmultiformrowcount':142C 'version':190C 'via':131C 'whose':124C","nicknames":[],"mitigations":[],"who_affected":"Teams running Apache OFBiz 24.09 releases before 24.09.08 on any platform, where the ServiceMultiEventHandler is reachable over HTTP. The description says a stock deployment has no authentication or CSRF requirement on the affected request path, so exposed instances are the main concern. unknown for whether custom deployments change this.","tier":"B","verified":{},"analyst_revisit_at":null,"fix_status":"available","audience":"businesses","plain_action":null,"pkeys":[],"ptokens":[],"labels":["apacheofbiz","high","java","runtime","selfhosted"],"campaign_type":null,"first_public_at":"2026-11-05T14:17:05+00:00","kev":null,"cvss_vector":null,"cvss_by":null,"poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-82904","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-82904","severity":null,"published_at":"2026-11-05T14:17:05+00:00","modified_at":"2026-11-05T14:17:05+00:00","first_seen_at":"2026-11-05T14:39:18+00:00","fetched_at":"2026-11-05T14:39:18+00:00","note":null}],"documents":[],"exploit_sources":[],"notice":"Free to read, with fair use of about 60 pages a minute. For higher limits or API access: sales@infrastack.ai"}