CVEDB API

Vulnerabilities

Vulnerable Software

Vulnerability Details CVE-2026-82904

Uncontrolled Resource Consumption in ServiceMultiEventHandler in Apache OFBiz 24.09 before 24.09.08 on all platforms allows a remote unauthenticated attacker to pin a server request thread for an attacker-chosen number of synchronous service dispatches, up to the signed-integer maximum, by submitting a single small HTTP request whose parameter names encode a row count via the "o" suffix used by multi-form submissions, because UtilHttp.getMultiFormRowCount derives that count from the largest such suffix with no upper bound and ServiceMultiEventHandler.invoke then loops that many times calling dispatcher.runSync, with the request-map for getFinAccountTransRunningTotalAndBalances reaching this handler with no authentication or CSRF requirement on a stock deployment. Users are recommended to upgrade to version 24.09.08, which fixes this issue.

Exploit prediction scoring system (EPSS) score

EPSS Score 0.006

EPSS Ranking 47.1%

CVSS Severity

CVSS v3 Score 7.5

References

https://lists.apache.org/thread.html/7b2syzksp7klt9fvhdg0olldvs2g83lz

Products affected by CVE-2026-82904

Apache » Ofbiz » Version: N/A

cpe:2.3:a:apache:ofbiz:-
Apache » Ofbiz » Version: 09.04

cpe:2.3:a:apache:ofbiz:09.04
Apache » Ofbiz » Version: 09.04.01

cpe:2.3:a:apache:ofbiz:09.04.01
Apache » Ofbiz » Version: 10.04

cpe:2.3:a:apache:ofbiz:10.04
Apache » Ofbiz » Version: 10.04.01

cpe:2.3:a:apache:ofbiz:10.04.01
Apache » Ofbiz » Version: 10.04.02

cpe:2.3:a:apache:ofbiz:10.04.02
Apache » Ofbiz » Version: 10.04.03

cpe:2.3:a:apache:ofbiz:10.04.03
Apache » Ofbiz » Version: 10.04.04

cpe:2.3:a:apache:ofbiz:10.04.04
Apache » Ofbiz » Version: 10.04.05

cpe:2.3:a:apache:ofbiz:10.04.05
Apache » Ofbiz » Version: 10.04.06

cpe:2.3:a:apache:ofbiz:10.04.06
Apache » Ofbiz » Version: 11.04

cpe:2.3:a:apache:ofbiz:11.04
Apache » Ofbiz » Version: 11.04.01

cpe:2.3:a:apache:ofbiz:11.04.01
Apache » Ofbiz » Version: 11.04.02

cpe:2.3:a:apache:ofbiz:11.04.02
Apache » Ofbiz » Version: 11.04.03

cpe:2.3:a:apache:ofbiz:11.04.03
Apache » Ofbiz » Version: 11.04.04

cpe:2.3:a:apache:ofbiz:11.04.04
Apache » Ofbiz » Version: 11.04.05

cpe:2.3:a:apache:ofbiz:11.04.05
Apache » Ofbiz » Version: 11.04.06

cpe:2.3:a:apache:ofbiz:11.04.06
Apache » Ofbiz » Version: 12.04

cpe:2.3:a:apache:ofbiz:12.04
Apache » Ofbiz » Version: 12.04.01

cpe:2.3:a:apache:ofbiz:12.04.01
Apache » Ofbiz » Version: 12.04.02

cpe:2.3:a:apache:ofbiz:12.04.02
Apache » Ofbiz » Version: 12.04.03

cpe:2.3:a:apache:ofbiz:12.04.03
Apache » Ofbiz » Version: 12.04.04

cpe:2.3:a:apache:ofbiz:12.04.04
Apache » Ofbiz » Version: 12.04.05

cpe:2.3:a:apache:ofbiz:12.04.05
Apache » Ofbiz » Version: 12.04.06

cpe:2.3:a:apache:ofbiz:12.04.06
Apache » Ofbiz » Version: 13.07

cpe:2.3:a:apache:ofbiz:13.07
Apache » Ofbiz » Version: 13.07.01

cpe:2.3:a:apache:ofbiz:13.07.01
Apache » Ofbiz » Version: 13.07.02

cpe:2.3:a:apache:ofbiz:13.07.02
Apache » Ofbiz » Version: 13.07.03

cpe:2.3:a:apache:ofbiz:13.07.03
Apache » Ofbiz » Version: 16.11.01

cpe:2.3:a:apache:ofbiz:16.11.01
Apache » Ofbiz » Version: 16.11.02

cpe:2.3:a:apache:ofbiz:16.11.02
Apache » Ofbiz » Version: 16.11.03

cpe:2.3:a:apache:ofbiz:16.11.03
Apache » Ofbiz » Version: 16.11.04

cpe:2.3:a:apache:ofbiz:16.11.04
Apache » Ofbiz » Version: 16.11.05

cpe:2.3:a:apache:ofbiz:16.11.05
Apache » Ofbiz » Version: 16.11.06

cpe:2.3:a:apache:ofbiz:16.11.06
Apache » Ofbiz » Version: 16.11.07

cpe:2.3:a:apache:ofbiz:16.11.07
Apache » Ofbiz » Version: 17.12.01

cpe:2.3:a:apache:ofbiz:17.12.01
Apache » Ofbiz » Version: 17.12.03

cpe:2.3:a:apache:ofbiz:17.12.03
Apache » Ofbiz » Version: 17.12.04

cpe:2.3:a:apache:ofbiz:17.12.04
Apache » Ofbiz » Version: 17.12.05

cpe:2.3:a:apache:ofbiz:17.12.05
Apache » Ofbiz » Version: 17.12.06

cpe:2.3:a:apache:ofbiz:17.12.06
Apache » Ofbiz » Version: 17.12.07

cpe:2.3:a:apache:ofbiz:17.12.07
Apache » Ofbiz » Version: 17.12.08

cpe:2.3:a:apache:ofbiz:17.12.08
Apache » Ofbiz » Version: 17.12.09

cpe:2.3:a:apache:ofbiz:17.12.09
Apache » Ofbiz » Version: 18.12.01

cpe:2.3:a:apache:ofbiz:18.12.01
Apache » Ofbiz » Version: 18.12.02

cpe:2.3:a:apache:ofbiz:18.12.02
Apache » Ofbiz » Version: 18.12.03

cpe:2.3:a:apache:ofbiz:18.12.03
Apache » Ofbiz » Version: 18.12.04

cpe:2.3:a:apache:ofbiz:18.12.04
Apache » Ofbiz » Version: 18.12.05

cpe:2.3:a:apache:ofbiz:18.12.05
Apache » Ofbiz » Version: 18.12.06

cpe:2.3:a:apache:ofbiz:18.12.06
Apache » Ofbiz » Version: 18.12.07

cpe:2.3:a:apache:ofbiz:18.12.07
Apache » Ofbiz » Version: 18.12.09

cpe:2.3:a:apache:ofbiz:18.12.09
Apache » Ofbiz » Version: 18.12.10

cpe:2.3:a:apache:ofbiz:18.12.10
Apache » Ofbiz » Version: 18.12.11

cpe:2.3:a:apache:ofbiz:18.12.11
Apache » Ofbiz » Version: 18.12.12

cpe:2.3:a:apache:ofbiz:18.12.12
Apache » Ofbiz » Version: 18.12.13

cpe:2.3:a:apache:ofbiz:18.12.13
Apache » Ofbiz » Version: 18.12.14

cpe:2.3:a:apache:ofbiz:18.12.14
Apache » Ofbiz » Version: 18.12.15

cpe:2.3:a:apache:ofbiz:18.12.15
Apache » Ofbiz » Version: 18.12.16

cpe:2.3:a:apache:ofbiz:18.12.16
Apache » Ofbiz » Version: 18.12.17

cpe:2.3:a:apache:ofbiz:18.12.17
Apache » Ofbiz » Version: 18.12.19

cpe:2.3:a:apache:ofbiz:18.12.19
Apache » Ofbiz » Version: 24.09.01

cpe:2.3:a:apache:ofbiz:24.09.01
Apache » Ofbiz » Version: 24.09.02

cpe:2.3:a:apache:ofbiz:24.09.02
Apache » Ofbiz » Version: 24.09.03

cpe:2.3:a:apache:ofbiz:24.09.03
Apache » Ofbiz » Version: 24.09.04

cpe:2.3:a:apache:ofbiz:24.09.04
Apache » Ofbiz » Version: 24.09.05

cpe:2.3:a:apache:ofbiz:24.09.05
Apache » Ofbiz » Version: 24.09.06

cpe:2.3:a:apache:ofbiz:24.09.06
Apache » Ofbiz » Version: 24.09.07

cpe:2.3:a:apache:ofbiz:24.09.07
Apache » Ofbiz » Version: 9.04

cpe:2.3:a:apache:ofbiz:9.04
Apache » Ofbiz » Version: 9.04.01

cpe:2.3:a:apache:ofbiz:9.04.01
Apache » Ofbiz » Version: 9.04.02

cpe:2.3:a:apache:ofbiz:9.04.02

Vulnerabilities

Vulnerable Software

Vulnerability Details CVE-2026-82904

Products

Pricing

Contact Us