Apache OFBiz CVE-2026-74841

Requires the target to run Apache OFBiz in multitenant mode (the multitenant deployment configuration) - the description explicitly scopes the flaw to 'multitenant deployments', where ContextFilter and LoginWorker derive a delegator name from the request-supplied userTenantId before validating the tenant. This is the key limiting factor: single-tenant OFBiz installations, which are the default, are not affected because the vulnerable per-tenant delegator lookup path is not exercised. On an affected multitenant instance, no authentication is required (CVSS PR:N) and no user interaction is needed (UI:N) - an unauthenticated network attacker simply submits many distinct userTenantId values. Exposure is further bounded by versions below 24.09.08; upgrading to 24.09.08 or later removes the condition.

Signals point in two directions and must be weighed carefully. The supplied CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:N) correctly captures a remote, unauthenticated, low-complexity trigger, and the Tags, CWE-400 and description all agree the real impact is resource exhaustion (denial of service). However, the supplied impact metrics are internally inconsistent with the mechanism: the flaw grows an in-memory cache and drives database load, which is an availability problem, yet the input vector asserts I:H (integrity high) with C:N - there is no described mechanism by which cache growth alters or corrupts data, so the I:H appears mislabeled and inflates the 9.1 score; a DoS-only scoring (A:H, I:N) is more defensible. The vuln.today decision label is act_now and a vendor patch is available, which argues for prompt remediation. Against that, EPSS is only 0.20% (10th percentile), there is no CISA KEV listing and no public exploit reference among the four advisory links, so there is no evidence of active exploitation or weaponization - the act_now label here reflects an easy-to-exploit unauthenticated DoS with an available fix rather than observed mass exploitation. A crucial scoping caveat: the description restricts the flaw to multitenant deployments, which in Apache OFBiz is a non-default configuration, materially narrowing the exposed population below what the network/unauthenticated vector alone implies. Net: a genuine, easy DoS worth patching promptly for anyone running OFBiz multitenancy, but the headline 9.1 overstates real-world risk for the typical single-tenant deployment.

An attacker reachable over the network sends a stream of HTTP requests to a multitenant Apache OFBiz instance, each carrying a different arbitrary userTenantId value. ContextFilter/LoginWorker build a per-tenant delegator name and ask DelegatorFactory to resolve it before the tenant is confirmed to exist, and the factory's cache retains every name - including unresolved ones - so the cache grows without bound, consuming memory and database resources until availability degrades. No authentication or user interaction is required, but no public exploit code is referenced in the available sources.