Skip to content
NewA calmer, faster ZeroHour
Vulnerability

CVE-2026-120010

Unauthenticated heap overflow DoS in SAP Message Server

CVSS 3.1
7.5 high
EPSS
—
Published
·
Modified
Analyze CVE-2026-120010 with Vani AIImpact, affected versions, exploitation status, mitigations and detection
AI analysisSummaries by Vani AI

SAP NetWeaver Application Server's Message Server does not size memory allocations correctly when handling certain HTTP requests. An unauthenticated remote attacker can send a crafted request that triggers a heap buffer overflow. The component aborts and stays unavailable until the framework restarts it. Confidentiality and integrity are not affected. SAP has not listed affected builds.

What to do: Apply SAP's update for CVE-2026-120010. No workaround is stated.

ProductAffected
SAP NetWeaver Application Server (SAP Message Server)—
Estimated exposure
No basis for an estimate.

Order-of-magnitude estimate by the model from install counts, market share and public scan data it knows; verify before quoting.

Description · NVD

SAP NetWeaver Application Server (SAP Message Server) does not properly size memory allocations when handling certain HTTP requests. An unauthenticated attacker could send a specially crafted request to trigger a heap buffer overflow in affected functionality. Successful exploitation causes the component to abort and remain unavailable until it is restarted by the framework, resulting in a high impact on availability of the system. There is no impact on confidentiality and integrity of the application.

Weakness
CWE-131
Vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
NVD CVE.org GitHub PoCs EPSS (—)

In the news

2 stories