Non notée
CVE-2026-74841 Apache OFBiz: Denial of Service via unauthenticated userTenantId in multitenant mode
Description
In multitenant deployments, ContextFilter and LoginWorker built a per-tenant delegator name from a request-supplied userTenantId parameter and requested a delegator for it before confirming the tenant existed. DelegatorFactory's internal cache retains every delegator name it is asked to resolve, including ones that fail to resolve, so an unauthenticated attacker could submit a stream of arbitrary tenant IDs to grow this cache without bound, driving unnecessary memory and database load.
Produits et versions touchés
| Produit | Versions touchées | Corrigé en |
|---|---|---|
| Apache OFBiz 24.09 | premières → < 24.09.08 | 24.09.08 |
Références
- lists.apache.org lists.apache.org
Chronologie
- Publiée
- Dernière modification
Autres CVE de Apache OFBiz
Les 97 CVE de Apache OFBiz →
CVE-2026-66903
Apache OFBiz: Authenticated Path Traversal in Catalog Image Management
Non notée
CVE-2026-71901
Apache OFBiz: Dispatch arbitrary internal services on SFA component
Non notée
CVE-2026-68524
Apache OFBiz: Pre-Authentication Remote Code Execution via Attacker-Controlled Screen Definition Loading
Non notée
CVE-2026-73577
Apache OFBiz: Unauthenticated path-suffix view authorization bypass
Non notée