CVE-2026-74841
Received Received - Intake

Memory Exhaustion via Unbounded Delegator Cache in Apache

Publication date: 2026-11-05

Last updated on: 2026-11-05

Assigner: Apache Software Foundation

Description
In multitenant deployments, ContextFilter and LoginWorker built a per-tenant delegator name from a request-supplied userTenantId parameter and requested a delegator for it before confirming the tenant existed. DelegatorFactory's internal cache retains every delegator name it is asked to resolve, including ones that fail to resolve, so an unauthenticated attacker could submit a stream of arbitrary tenant IDs to grow this cache without bound, driving unnecessary memory and database load.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-11-05
Last Modified
2026-11-05
Generated
2026-11-05
AI Q&A
2026-11-05
EPSS Evaluated
N/A
NVD
CVE-2026-74841
EUVD
EUVD-2026-117489

Affected Vendors & Products

Showing 1 associated CPE
Vendor Product Version / Range
Apache Software Foundation Apache OFBiz 0

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-770 The product allocates a reusable resource or group of resources on behalf of an actor without imposing any intended restrictions on the size or number of resources that can be allocated.
CWE-400 The product does not properly control the allocation and maintenance of a limited resource.

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

This vulnerability exists in multitenant deployments of Apache OFBiz. The ContextFilter and LoginWorker components build a delegator name from a user-supplied tenant ID without first verifying if the tenant exists. DelegatorFactory caches every delegator name, including invalid ones, allowing an unauthenticated attacker to repeatedly submit arbitrary tenant IDs. This causes the cache to grow indefinitely, consuming excessive memory and database resources.

Impact Analysis

An attacker could exploit this to cause a denial of service by flooding the system with requests, leading to high memory usage, database overload, and degraded performance. Systems with limited resources are particularly vulnerable to crashes or slowdowns.

Mitigation Strategies

Apply the latest security patches or updates from Apache OFBiz to address the delegator cache issue. Monitor memory and database usage for unusual spikes. Restrict unauthenticated access to tenant-related endpoints. Review and limit delegator cache retention policies.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-74841. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart

Security Radar

News mentioning this vulnerability
Loading related security news...