Description

SAP Approuter does not enforce sufficient flow control in certain functionality. An attacker with low privileges could send high volumes of data without consuming responses, causing unbounded memory growth. This results in a low impact on availability. There is no impact on confidentiality and integrity.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "4.3",
  "pubDate": "2026-08-11T01:17:22.880Z",
  "pubdate": "2026-08-11T01:17:22.880Z",
  "executiveSummary": "SAP Approuter is affected by an insufficient flow control vulnerability that enables low-privileged authenticated attackers to trigger unbounded memory growth.\nThe vulnerability specifically impacts the availability of the affected system by causing excessive resource consumption when an attacker transmits high volumes of data without consuming the corresponding responses.\nWhile the integrity and confidentiality of the underlying data remain entirely uncompromised, the resource exhaustion condition imposes a low impact on overall system availability.\nExploitation of this flaw requires low privileges, allowing a threat actor with basic access capabilities to initiate the attack sequence.\nThe risk implications are centered around denial-of-service conditions resulting from uncontrolled memory allocation within the application architecture.\nNo specific version numbers or complex exploitation prerequisites are mentioned beyond the ability to interact with the vulnerable functionality and transmit sustained high volumes of data.",
  "technicalDetails": "The root cause of the vulnerability stems from the failure of SAP Approuter to enforce sufficient flow control mechanisms within specific application functionalities.\nWithout adequate flow control or backpressure handling, the application lacks the necessary rate-limiting or buffer management controls to restrict incoming data streams when downstream processing or response consumption stalls.\nAn attacker leverages this architectural oversight by initiating connections and transmitting high volumes of data payload into the vulnerable component without reading or acknowledging the corresponding responses.\nAs the application continuously ingests incoming data while failing to flush or properly bound the associated memory buffers, it experiences unbounded memory growth.\nThe attack flow proceeds as follows: First, the low-privileged attacker establishes a communication channel with the vulnerable SAP Approuter functionality. Second, the attacker floods the endpoint with continuous high-volume data payloads. Third, by intentionally withholding response consumption, the attacker prevents the release of allocated buffer memory. Finally, the sustained influx of data leads to continuous memory accumulation until resource exhaustion occurs.\nThe vulnerable component is the SAP Approuter request handling and flow control logic.\nAuthentication is required to execute the attack, specifically utilizing low privileges within the system.\nThe payload behavior is characterized by continuous data transmission designed to saturate internal memory buffers without triggering automatic connection termination or garbage collection mechanisms.\nThe post-exploitation impact is strictly limited to availability degradation, manifesting as a low-impact denial of service due to memory exhaustion, with no effect on system confidentiality or integrity."
}