CVE-2026-82904

Uncontrolled Resource Consumption in ServiceMultiEventHandler in Apache OFBiz 24.09 before 24.09.08 on all platforms allows a remote unauthenticated attacker to pin a server request thread for an attacker-chosen number of synchronous service dispatches, up to the signed-integer maximum, by...

CVE-2026-82904 Apache OFBiz: Unbounded multi-form row count from a parameter name

Uncontrolled Resource Consumption in ServiceMultiEventHandler in Apache OFBiz 24.09 before 24.09.08 on all platforms allows a remote unauthenticated attacker to pin a server request thread for an attacker-chosen number of synchronous service dispatches, up to the signed-integer maximum, by...

CVE-2026-82904

Apache OFBiz versions 24.09 before 24.09.08 on all platforms are vulnerable to Uncontrolled Resource Consumption in the ServiceMultiEventHandler. A remote unauthenticated attacker can pin a server request thread by submitting a small HTTP request with parameter names encoding a row count via the **