CVE-2026-109793 PUBLISHED

Denial of Service (DoS) vulnerability in SAP NetWeaver Application Server ABAP (Internet Communication Manager) and SAP Web Dispatcher

Assigner: sap
Reserved: 13.10.2026 Published: 10.11.2026 Updated: 10.11.2026

SAP NetWeaver Application Server ABAP and SAP Web Dispatcher do not sufficiently validate certain header values processed during inbound request handling. An unauthenticated attacker could send a specially crafted request to cause the affected process to become unavailable.This results in a high impact on availability. There is no impact on confidentiality and integrity.

Metrics

CVSS Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
CVSS Score: 7.5

Product Status

Vendor SAP_SE
Product SAP NetWeaver Application Server ABAP (Internet Communication Manager) and SAP Web Dispatcher
Versions Default: unaffected
  • Version WEBDISP 9.16 is affected
  • Version KERNEL 9.16 is affected
  • Version 9.20 is affected
  • Version 9.21 is affected

References

Problem Types