Memory Exhaustion Vulnerability in Multitenant Deployments of Apache Products

CVE-2026-74841

What is CVE-2026-74841?

In environments utilizing multitenant configurations, a vulnerability exists within Apache's ContextFilter and LoginWorker components. When processing requests, a per-tenant delegator name is generated based on the userTenantId parameter, which can be submitted by an unauthenticated attacker. This process occurs without confirming the existence of the given tenant, leading to significant performance issues. The internal cache of DelegatorFactory retains all delegator names requested, including those that fail to resolve. Consequently, an attacker could exploit this flaw by flooding the system with arbitrary tenant IDs, resulting in unbounded growth of the cache and causing excessive memory and database load.

References