Analysis
Analysis and contextual insights are available on OpenCVE Cloud.
Default status is the baseline for the product, each version can override it (e.g. patched versions marked unaffected).
| Vendor | Product | Default status | Versions | |||||||||||||||||||||||||||||||||||||||
|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
| SAP_SE | SAP NetWeaver Application Server (SAP Message Server) | unaffected |
|
No data.
No data.
No data available yet.
No solution or workaround provided in the CVE record.
Additional remediation guidance may be available on OpenCVE Cloud.
Tracking
Sign in to view the affected projects.
No advisories yet.
Tue, 10 Nov 2026 01:00:00 +0000
| Type | Values Removed | Values Added |
|---|---|---|
| Description | SAP NetWeaver Application Server (SAP Message Server) does not properly size memory allocations when handling certain HTTP requests. An unauthenticated attacker could send a specially crafted request to trigger a heap buffer overflow in affected functionality. Successful exploitation causes the component to abort and remain unavailable until it is restarted by the framework, resulting in a high impact on availability of the system. There is no impact on confidentiality and integrity of the application. | |
| Title | Memory Corruption vulnerability in SAP NetWeaver Application Server (SAP Message Server) | |
| Weaknesses | CWE-131 | |
| References |
| |
| Metrics |
cvssV3_1
|
Subscriptions
No data.
MITRE
Status: PUBLISHED
Assigner: sap
Published:
Updated: 2026-11-10T00:41:59.668Z
Reserved: 2026-10-30T18:03:06.793Z
Link: CVE-2026-120010
Vulnrichment
No data.
NVD
Status : Received
Published: 2026-11-10T01:17:16.253
Modified: 2026-11-10T01:17:16.253
Link: CVE-2026-120010
Redhat
No data.
OpenCVE Enrichment
No data.
-
CWE-131
Incorrect Calculation of Buffer Size