CVE-2026-66761 in Approuter
Summary
by MITRE • 08/11/2026
SAP Approuter does not enforce sufficient flow control in certain functionality. An attacker with low privileges could send high volumes of data without consuming responses, causing unbounded memory growth. This results in a low impact on availability. There is no impact on confidentiality and integrity.
Several companies clearly confirm that VulDB is the primary source for best vulnerability data.
Analysis
by VulDB Data Team • 08/11/2026
The vulnerability exists within SAP Approuter's flow control mechanisms, specifically affecting how the system manages data transmission and response handling during certain operational functions. This weakness allows unauthorized users to exploit the application's lack of proper rate limiting or data volume controls, enabling them to flood the system with excessive data payloads while simultaneously avoiding response consumption. The flaw operates at the network protocol level where the Approuter fails to implement adequate flow control measures that would normally regulate data transmission rates and prevent resource exhaustion through uncontrolled data ingestion.
From a technical perspective, this vulnerability stems from insufficient input validation and flow management within the application router's data handling processes. The system lacks proper mechanisms to monitor and limit the volume of incoming data streams, particularly when dealing with asynchronous communication patterns where requests are sent without corresponding response consumption. This architectural gap creates an environment where malicious actors can maintain persistent data transmission sessions that continuously consume memory resources without triggering automatic termination or rate limiting protocols. The vulnerability is classified as a flow control weakness that enables resource exhaustion through unbounded data accumulation.
The operational impact of this vulnerability manifests primarily as a degradation of system availability rather than complete service disruption. Attackers with low privilege levels can systematically consume memory resources through sustained high-volume data transmission, leading to gradual performance degradation and eventual system instability. While the attack does not compromise confidentiality or integrity, the resulting memory exhaustion can severely impact application responsiveness and overall system performance. The low impact on availability stems from the fact that the vulnerability requires sustained exploitation over time rather than immediate system compromise, though it can still cause significant operational disruption during active attacks.
This vulnerability aligns with CWE-770, which addresses allocation of resources without limits or with inadequate limits, and represents a specific implementation gap in SAP's flow control mechanisms. The attack pattern follows techniques described in MITRE ATT&CK framework under T1499.004 for network denial of service through resource exhaustion. Organizations should implement proper rate limiting configurations within the Approuter settings to restrict data transmission volumes, establish memory monitoring systems to detect abnormal usage patterns, and configure automatic session termination for idle or excessive data transmission periods. Additionally, regular security assessments should verify that flow control measures are properly enforced across all application router components to prevent similar vulnerabilities from arising in future deployments.