CVE-2026-66761
MediumCVSS 4.3Exploitation Probability (EPSS)
Low risk13th percentile - higher than 13% of all known CVEs
Summary
SAP Approuter does not enforce sufficient flow control in certain functionality. An attacker with low privileges could send high volumes of data without consuming responses, causing unbounded memory growth. This results in a low impact on availability, with no impact on confidentiality and integrity.
Risk Assessment
The risk is the potential exhaustion of memory resources, which could lead to performance degradation or unavailability of the service for users.
Recommendation
It is recommended to implement data flow limits and monitor memory usage in SAP Approuter, and apply available security patches.
Original NVD description (English source)
SAP Approuter does not enforce sufficient flow control in certain functionality. An attacker with low privileges could send high volumes of data without consuming responses, causing unbounded memory growth. This results in a low impact on availability. There is no impact on confidentiality and integrity.