CVE-2026-82904

Name of the Vulnerable Software and Affected Versions Apache OFBiz versions 24.09 through 24.09.07

Description Uncontrolled resource consumption in ServiceMultiEventHandler allows a remote unauthenticated attacker to pin a server request thread for a specified number of synchronous service dispatches, up to the signed-integer maximum. This occurs when a small HTTP request is submitted with parameter names encoding a row count via the o suffix used by multi-form submissions. The UtilHttp.getMultiFormRowCount function derives this count from the largest suffix without an upper bound, and ServiceMultiEventHandler.invoke() subsequently loops that many times calling dispatcher.runSync(). In a stock deployment, the request-map for getFinAccountTransRunningTotalAndBalances reaches this handler without requiring authentication or CSRF protection.

Recommendations Upgrade to version 24.09.08.