CVE-2026-109794 · Vendor
NO FIX YET
SAP NetWeaver Application Server ABAP, ABAP Platform and SAP Web Dispatcher do not handle resource consumption properly for certain requests. An unauthenticated attacker can send crafted requests that drive up resource use and disrupt the service, with no confidentiality or integrity impact.
first public Nov 10, 2026 · 2 sources
Could this affect your app?
Free first check from your website. Connect your repo for the full answer.
Organizations running SAP NetWeaver Application Server ABAP, ABAP Platform or SAP Web Dispatcher that accept network requests from untrusted sources are exposed. The sources do not name the affected versions or the configurations that are vulnerable, so the exact scope is unknown.
Not affected if unknown
Who cares abap, dos, netweaver, sap, self-hosted, unauthenticated, web-dispatcher
No fix yet, per the sources.
SAP NetWeaver Application Server ABAP, ABAP Platform, and SAP Web Dispatcher do not sufficiently handle resource consumption when processing certain requests. An unauthenticated attacker could send specially crafted requests to the affected component, causing excessive resource utilization and service disruption. This results in a high impact on availability. There is no impact on confidentiality and integrity.
This page as .md · .json · CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
NVD data is provided by NIST and is public domain. Posts quoted belong to their authors.
Check it with your coding agent
It reads this page and tells you if your code is affected.
Are you affected?
Ask from here. InfraStack checks the affected versions against your stack and answers in your inbox.
InfraStack checks the affected versions against your stack and answers in Slack, with the evidence and the fix.