Uncontrolled Resource Consumption in Apache OFBiz by Apache
CVE-2026-82904

7.5HIGH

Key Information:

Vendor

Apache
Status
Apache Ofbiz
Vendor
CVE Published:
5 November 2026

What is CVE-2026-82904?

The vulnerability in Apache OFBiz allows a remote unauthenticated attacker to exploit uncontrolled resource consumption by crafting a small HTTP request that manipulates parameter names. This results in the ability to dictate the number of synchronous service dispatches, potentially overwhelming the server by consuming thread resources. The issue resides in the ServiceMultiEventHandler component, where the row count for service processing is derived from request parameters without upper limits, enabling the attacker to execute multiple operations in a single request. It is advisable for users to upgrade to version 24.09.08 to mitigate this vulnerability.

Affected Version(s)

Apache OFBiz 0 < 24.09.08

References

https://lists.apache.org/thread.html/7b2syzksp7klt9fvhdg0...
vendor-advisory

CVSS V3.1

Score:
7.5
Severity:
HIGH
Confidentiality:
None
Integrity:
None
Availability:
None
Attack Vector:
Network
Attack Complexity:
Low
Privileges Required:
None
User Interaction:
None
Scope:
Unchanged

Timeline

  • Vulnerability published

  • Vulnerability Reserved

Credit

Bartlomiej Dmitruk at striga.ai
CyberLeo
Krishna Uprit
.