{"id":"CVE-2026-109793","kind":"vulnerability","aliases":["CVE-2026-109793"],"related":[],"title":"SAP NetWeaver ABAP and Web Dispatcher: crafted headers crash the process","description":"SAP NetWeaver Application Server ABAP and SAP Web Dispatcher do not sufficiently validate certain header values processed during inbound request handling. An unauthenticated attacker could send a specially crafted request to cause the affected process to become unavailable.This results in a high impact on availability. There is no impact on confidentiality and integrity.","summary":"SAP NetWeaver ABAP (ICM) and SAP Web Dispatcher do not sufficiently validate certain header values in inbound requests. An unauthenticated attacker can send a crafted request that makes the process unavailable (CVSS 7.5, availability only). Fix per SAP Note 3808627; patched versions not confirmed from a primary source.","severity":"high","cvss":7.5,"epss":null,"exploited":false,"exploited_at":null,"products":[{"name":"SAP NetWeaver Application Server ABAP","fixed":[],"affected":"","ecosystem":"vendor"},{"name":"SAP Web Dispatcher","fixed":[],"affected":"WEBDISP 9.16 (unconfirmed, from CVE-list mirror)","ecosystem":"vendor"},{"name":"SAP NetWeaver Application Server ABAP (kernel)","fixed":[],"affected":"KERNEL 9.16, 9.20, 9.21 (unconfirmed, from CVE-list mirror)","ecosystem":"vendor"}],"ecosystems":["vendor"],"tags":["abap","dos","icm","netweaver","sap","unauthenticated","vendor","web-dispatcher"],"not_affected_if":[],"how_to_check":"Open SAP Note 3808627 in SAP for Me and compare your kernel (SM51 > Release Notes, or disp+work -V) and Web Dispatcher (sapwebdisp -v) versions with its list. Mirror lists WEBDISP 9.16 and KERNEL 9.16, 9.20, 9.21 (unconfirmed).","fix":null,"status":"open","published_at":"2026-11-10T01:17:13+00:00","first_seen_at":"2026-11-10T01:26:36+00:00","triaged_at":"2026-11-10T01:28:41+00:00","updated_at":"2026-11-10T01:37:15+00:00","category":"vendor","confidence":0.5,"triage":{"at":"2026-11-10T01:28:41Z","model":"claude-haiku-5-5","output":{"fix":"unknown","reach":"internet","title":"SAP NetWeaver ABAP and Web Dispatcher: crafted headers crash the process","impact":"low","summary":"SAP NetWeaver Application Server ABAP and SAP Web Dispatcher do not validate certain inbound HTTP header values. An unauthenticated attacker can send a crafted request that makes the affected process unavailable, a denial of service.","audience":"businesses","category":"vendor","nicknames":[],"who_cares":["sap","netweaver","web-dispatcher","abap"],"confidence":0.6,"fix_status":"unknown","needs_auth":"no","worst_case":"Affected SAP process becomes unavailable; no data exposure","analyst_note":"Find SAP's advisory and the affected release and patch list for CVE-2026-109793 in the SAP Security Patch Day notes; the NVD entry gives no versions.","how_to_check":"- unknown","plain_action":"","product_name":"SAP NetWeaver Application Server ABAP","needs_analyst":true,"not_affected_if":[],"who_is_affected":"Organizations running SAP NetWeaver Application Server ABAP or SAP Web Dispatcher that accept inbound requests from untrusted networks are exposed to the availability impact. The sources do not name affected releases or the specific header or configuration involved.","user_interaction":"no","product_ecosystem":"vendor","needs_special_setup":"unknown","severity_if_unknown":"unknown"},"cost_usd":0.000715,"input_tokens":4570,"output_tokens":517,"severity_before":"high"},"analyst_status":"done","analyst_note":"Find SAP's advisory and the affected release and patch list for CVE-2026-109793 in the SAP Security Patch Day notes; the NVD entry gives no versions.","search":"'-109793':14A,17A '-2026':13A,16A '3808627':81B '7.5':74B 'abap':3A,22A,30A,32B,44B,94C 'affect':123C 'applic':92C 'application':20A,28A 'attack':62B,113C 'avail':75B,134C 'becom':126C 'caus':121C 'certain':54B,103C 'confidenti':140C 'confirm':85B 'could':114C 'craft':7A,66B,118C 'crash':9A 'cve':12A,15A 'cvss':73B 'dispatch':6A,41B,49B,98C 'dispatcher':25A 'dos':33B 'fix':77B 'handl':110C 'header':8A,55B,104C 'high':131C 'icm':34B,45B 'impact':132C,138C 'inbound':58B,108C 'integr':142C 'kernel':31A 'make':69B 'netweav':2A,35B,43B,91C 'netweaver':19A,27A 'note':80B 'patch':82B 'per':78B 'primari':88B 'process':11A,71B,106C,124C 'request':59B,67B,109C,119C 'result':128C 'sap':1A,18A,23A,26A,36B,42B,47B,79B,90C,96C 'send':64B,115C 'server':21A,29A,93C 'sourc':89B 'special':117C 'suffici':52B,101C 'unauthent':37B,61B,112C 'unavail':72B 'unavailable.this':127C 'valid':53B,102C 'valu':56B,105C 'vendor':38B 'version':83B 'web':5A,24A,40B,48B,97C 'web-dispatch':39B","nicknames":[],"mitigations":[],"who_affected":"Self-run SAP NetWeaver Application Server ABAP systems and SAP Web Dispatcher that handle inbound HTTP(S) requests through the Internet Communication Manager. An unauthenticated attacker who can reach the HTTP port can send a crafted request that makes the process unavailable (no confidentiality or integrity impact). Systems whose ICM/Web Dispatcher is not reachable by untrusted clients are at lower risk.","tier":"B","verified":{},"analyst_revisit_at":null,"fix_status":"none","audience":"businesses","plain_action":null,"pkeys":["netweaverapplicationserverabap","netweaverapplicationserverabapkernel","sapnetweaverapplicationserverabap","sapnetweaverapplicationserverabapkernel","sapwebdispatcher","webdispatcher"],"ptokens":["abap","application","dispatcher","kernel","netweaver","sap","server","web"],"labels":["abap","dos","high","icm","netweaver","sap","unauthenticated","vendor","webdispatcher"],"campaign_type":null,"search_a":"'-109793':14A,17A '-2026':13A,16A 'abap':3A,22A,30A 'application':20A,28A 'craft':7A 'crash':9A 'cve':12A,15A 'dispatch':6A 'dispatcher':25A 'header':8A 'kernel':31A 'netweav':2A 'netweaver':19A,27A 'process':11A 'sap':1A,18A,23A,26A 'server':21A,29A 'web':5A,24A","search_b":"'3808627':81B '7.5':74B 'abap':32B,44B 'attack':62B 'avail':75B 'certain':54B 'confirm':85B 'craft':66B 'cvss':73B 'dispatch':41B,49B 'dos':33B 'fix':77B 'header':55B 'icm':34B,45B 'inbound':58B 'make':69B 'netweav':35B,43B 'note':80B 'patch':82B 'per':78B 'primari':88B 'process':71B 'request':59B,67B 'sap':36B,42B,47B,79B 'send':64B 'sourc':89B 'suffici':52B 'unauthent':37B,61B 'unavail':72B 'valid':53B 'valu':56B 'vendor':38B 'version':83B 'web':40B,48B 'web-dispatch':39B","search_c":"'abap':94C 'affect':123C 'applic':92C 'attack':113C 'avail':134C 'becom':126C 'caus':121C 'certain':103C 'confidenti':140C 'could':114C 'craft':118C 'dispatch':98C 'handl':110C 'header':104C 'high':131C 'impact':132C,138C 'inbound':108C 'integr':142C 'netweav':91C 'process':106C,124C 'request':109C,119C 'result':128C 'sap':90C,96C 'send':115C 'server':93C 'special':117C 'suffici':101C 'unauthent':112C 'unavailable.this':127C 'valid':102C 'valu':105C 'web':97C","cause_entry":null,"cause_path":null,"disclosures_checked_at":null,"first_public_at":"2026-11-10T01:17:13+00:00","kev":null,"cvss_vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","cvss_by":"cna@sap.com","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-109793","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-109793","severity":null,"published_at":"2026-11-10T01:17:13+00:00","modified_at":"2026-11-10T01:17:13+00:00","first_seen_at":"2026-11-10T01:26:36+00:00","fetched_at":"2026-11-10T01:26:36+00:00","note":null},{"source":"analyst","external_id":"CVE-2026-109793:2395","url":"https://hol.org/guard/security/cves/CVE-2026-109793-denial-of-service-dos-vulnerability-in-sap","severity":null,"published_at":"2026-11-10T01:37:15+00:00","modified_at":"2026-11-10T01:37:15+00:00","first_seen_at":"2026-11-10T01:37:15+00:00","fetched_at":"2026-11-10T01:37:15+00:00","note":"SAP note 3808627 (me.sap.com, login-gated) is the primary; not readable here and Nov 2026 patch day page not yet published in search. Affected list taken from CVE-list mirror (HOL), not verified: WEBDISP 9.16; KERNEL 9.16, 9.20, 9.21. Fix versions unknown. No exploitation reported. Nothing marked verified.","cites":["https://hol.org/guard/security/cves/CVE-2026-109793-denial-of-service-dos-vulnerability-in-sap","https://nvd.nist.gov/vuln/detail/CVE-2026-109793"]}],"documents":[{"id":112474,"url":"https://hol.org/guard/security/cves/CVE-2026-109793-denial-of-service-dos-vulnerability-in-sap","title":"HOL Guard record CVE-2026-109793 (CVE list mirror)","kind":"other","source":"analyst","publisher":null,"text":null,"published_at":null,"relation":"describes","confidence":null,"note":null},{"id":112475,"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-109793","title":"NVD CVE-2026-109793","kind":"other","source":"analyst","publisher":null,"text":null,"published_at":null,"relation":"mentions","confidence":null,"note":null}],"disclosures":[],"exploit_sources":[],"notice":"Free to read, with fair use of about 60 pages a minute. For higher limits or API access: sales@infrastack.ai"}