SAP NetWeaver Application Server (SAP Message Server) does not properly size memory allocations when handling certain HTTP requests. An unauthenticated attacker could send a specially crafted request to trigger a heap buffer overflow in affected functionality. Successful exploitation causes the component to abort and remain unavailable until it is restarted by the framework, resulting in a high impact on availability of the system. There is no impact on confidentiality and integrity of the application.
Metrics
Affected Vendors & Products
No data.
No data.
No data.
No data.
Advisories
No advisories yet.
Fixes
Solution
No solution given by the vendor.
Workaround
No workaround given by the vendor.
References
History
Tue, 10 Nov 2026 01:00:00 +0000
| Type | Values Removed | Values Added |
|---|---|---|
| Description | SAP NetWeaver Application Server (SAP Message Server) does not properly size memory allocations when handling certain HTTP requests. An unauthenticated attacker could send a specially crafted request to trigger a heap buffer overflow in affected functionality. Successful exploitation causes the component to abort and remain unavailable until it is restarted by the framework, resulting in a high impact on availability of the system. There is no impact on confidentiality and integrity of the application. | |
| Title | Memory Corruption vulnerability in SAP NetWeaver Application Server (SAP Message Server) | |
| Weaknesses | CWE-131 | |
| References |
| |
| Metrics |
cvssV3_1
|
Projects
Sign in to view the affected projects.
MITRE
Status: PUBLISHED
Assigner: sap
Published:
Updated: 2026-11-10T00:41:59.668Z
Reserved: 2026-10-30T18:03:06.793Z
Link: CVE-2026-120010
Vulnrichment
No data.
NVD
Status : Received
Published: 2026-11-10T01:17:16.253
Modified: 2026-11-10T01:17:16.253
Link: CVE-2026-120010
Redhat
No data.
OpenCVE Enrichment
No data.
Weaknesses