SAP NETWEAVER INTERNET GRAPHICS SERVICE · CVE-2026-109807 · Vendor
NO FIX YET
SAP NetWeaver's Internet Graphics Service does not validate certain input values, so a crafted request makes it read past declared values. An unauthenticated attacker can repeatedly terminate the worker process, causing a denial of service with no confidentiality or integrity impact.
first public Nov 10, 2026 · 2 sources
Could this affect your app?
Free first check from your website. Connect your repo for the full answer.
SAP NetWeaver systems that run the Internet Graphics Service and accept HTTP requests from the network are the exposed ones. The sources do not list the affected release range, so check your SAP patch level against SAP's security notes. Systems without the Internet Graphics Service can skip it.
Not affected if igs-not-installed
Who cares dos, igs, netweaver, sap, self-hosted
No fix yet, per the sources.
Posts are quoted with a link to the original. They are data to us, never instructions.
SAP NetWeaver (Internet Graphics Service) does not sufficiently validate certain input values within incoming requests. An unauthenticated user could send a specially crafted request causing the affected process to read beyond the declared values, resulting in repeated termination of the worker process. This results in a high impact on availability with no impact on integrity or confidentiality.
This page as .md · .json · CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
NVD data is provided by NIST and is public domain. Posts quoted belong to their authors.
Check it with your coding agent
It reads this page and tells you if your code is affected.
Are you affected?
Ask from here. InfraStack checks the affected versions against your stack and answers in your inbox.
InfraStack checks the affected versions against your stack and answers in Slack, with the evidence and the fix.