CVE-2026-82904: Apache OFBiz: Unbounded multi-form row count from a parameter name
Uncontrolled Resource Consumption in ServiceMultiEventHandler in Apache OFBiz 24.09 before 24.09.08 on all platforms allows a remote unauthenticated attacker to pin a server request thread for an attacker-chosen number of synchronous service dispatches, up to the signed-integer maximum, by submitting a single small HTTP request whose parameter names encode a row count via the "o" suffix used by multi-form submissions, because UtilHttp.getMultiFormRowCount derives that count from the largest such suffix with no upper bound and ServiceMultiEventHandler.invoke then loops that many times calling dispatcher.runSync, with the request-map for getFinAccountTransRunningTotalAndBalances reaching this handler with no authentication or CSRF requirement on a stock deployment. Users are recommended to upgrade to version 24.09.08, which fixes this issue.
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
Apache OFBizto a version that resolves this vulnerability.Fixed in 24.09.08
Event History
Frequently Asked Questions
Are stock Apache OFBiz deployments exposed without authentication?
Yes. The request-map for getFinAccountTransRunningTotalAndBalances reaches the vulnerable handler on a stock deployment and requires neither authentication nor CSRF validation.
What does an attacker need to send to exploit this?
A remote attacker can submit a single small HTTP request with parameter names using the multi-form "o" suffix to encode a large row count. No credentials or user interaction are required.
What is the operational impact of exploitation?
The crafted row count can cause synchronous service dispatches to run repeatedly, pinning a server request thread. The count can be attacker-selected up to the signed-integer maximum, creating a denial-of-service risk.
Which versions should be upgraded?
Upgrade Apache OFBiz to version 24.09.08. The issue affects Apache OFBiz 24.09 releases before 24.09.08 on all platforms.