CVE-2026-109800 · Vendor
NO FIX YET
SAP Web Dispatcher does not validate certain inputs, which can cause memory corruption and terminate the process. An authenticated low-privilege user can send crafted input to take down the Web Dispatcher and every backend system reachable through it.
first public Nov 10, 2026 · 2 sources
Could this affect your app?
Free first check from your website. Connect your repo for the full answer.
SAP systems that expose the Web Dispatcher to users who hold a non-administrative login. The sources describe a denial of service only, with no confidentiality or integrity impact. Teams that do not run SAP Web Dispatcher can skip it.
Not affected if no-authenticated-users, no-web-dispatcher
Who cares sap, self-hosted, web-dispatcher
sapwebdisp -version outputUnknown from the sources.
SAP Web Dispatcher does not sufficiently validate certain inputs during processing, which could lead to memory corruption. An attacker authenticated as a non-administrative user could exploit this vulnerability by providing specially crafted input, causing the Web Dispatcher process to terminate without user interaction. As a result, the Web Dispatcher and all backend systems reachable through it become unavailable, leading to a high impact on availability. There is no impact on confidentiality or integrity of the application.
This page as .md · .json · CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:N/I:N/A:H
NVD data is provided by NIST and is public domain. Posts quoted belong to their authors.
Check it with your coding agent
It reads this page and tells you if your code is affected.
Are you affected?
Ask from here. InfraStack checks the affected versions against your stack and answers in your inbox.
InfraStack checks the affected versions against your stack and answers in Slack, with the evidence and the fix.