An unbounded multi-form row count parameter enables an attacker to trigger an arbitrary number of synchronous service dispatches within a single HTTP request. The service handler loops according to the derived count, consuming a server thread for each dispatch. Because the attacker can specify a count up to the signed integer maximum and no authentication or CSRF checks are required, an unauthenticated user can severely degrade server availability.

Apache OFBiz 24.09 on all platforms, versions 24.09 through 24.09.07. These releases contain the vulnerable ServiceMultiEventHandler logic.

The CVSS score is 7.5 and the EPSS score is not available, with no listing in CISA KEV. However, the attack path requires only a crafted HTTP request and is therefore trivial to execute. A successful exploitation could exhaust thread pools and lead to a denial of service for legitimate users.