Skip to content
NewA calmer, faster ZeroHour
Vulnerability

CVE-2026-109793

Unauthenticated DoS via header handling in SAP NetWeaver and Web Dispatcher

CVSS 3.1
7.5 high
EPSS
—
Published
·
Modified
Analyze CVE-2026-109793 with Vani AIImpact, affected versions, exploitation status, mitigations and detection
AI analysisSummaries by Vani AI

SAP NetWeaver Application Server ABAP and SAP Web Dispatcher do not sufficiently validate certain header values during inbound request handling (stack-based buffer overflow). An unauthenticated attacker on the network can send a crafted request with no user interaction and make the affected process unavailable. Confidentiality and integrity are not affected. SAP has not listed affected builds.

What to do: Apply SAP's update for CVE-2026-109793. SAP has not named a fixed version or workaround.

ProductAffected
SAP NetWeaver Application Server ABAP—
SAP Web Dispatcher—
Estimated exposure
No basis for an estimate.

Order-of-magnitude estimate by the model from install counts, market share and public scan data it knows; verify before quoting.

Description · NVD

SAP NetWeaver Application Server ABAP and SAP Web Dispatcher do not sufficiently validate certain header values processed during inbound request handling. An unauthenticated attacker could send a specially crafted request to cause the affected process to become unavailable.This results in a high impact on availability. There is no impact on confidentiality and integrity.

Weakness
CWE-121
Vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
NVD CVE.org GitHub PoCs EPSS (—)

In the news

2 stories