by Kastro
Paper/Archive/CVE-2026-74841

CVE-2026-74841

Apache Software Foundation Apache OFBiz — Apache OFBiz: Denial of Service via unauthenticated userTenantId in multitenant mode

EPSS 0.2%CVSS 9.1
critical.is priorityof 100
29
CVSS 9.1 (ADP)9.1 / 10 × 3027.3Not in CISA KEV+300.0EPSS percentile 9.7.097 × 201.9No public exploit+100.0SSVC exploitation: none+100.0
Description · from the CVE record

In multitenant deployments, ContextFilter and LoginWorker built a per-tenant delegator name from a request-supplied userTenantId parameter and requested a delegator for it before confirming the tenant existed. DelegatorFactory's internal cache retains every delegator name it is asked to resolve, including ones that fail to resolve, so an unauthenticated attacker could submit a stream of arbitrary tenant IDs to grow this cache without bound, driving unnecessary memory and database load.

Affected

ProductAffectedFixed inSource
Apache OFBiz< 24.09.0824.09.08CNA

Scores by source

CISA ADP9.1CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:H
CISA ADPSSVCExploitation: none · Automatable: yes · Technical impact: partial

References

advisorylists.apache.org/thread.html/7b2syzksp7klt9fvhdg0olldvs2g83lz