high2026-10-13SAP NetWeaver / Web Dispatcher — ICM HTTP/2CVE-2026-58249
Memory Corruption in ICM HTTP/2 Handling
SAP NetWeaver AS ABAP, SAP Web Dispatcher, Content Server, HANA XS
Our Take
Availability-only, but unauthenticated and on by default for newer kernels. Check whether HTTP/2 is actually on and reachable, then bundle the kernel update with the other kernel-level fix this month.
Vulnerability Detail
Memory corruption in the Internet Communication Manager lets an unauthenticated attacker crash processes through HTTP/2 traffic, disrupting availability. Only systems with HTTP/2 enabled and reachable are exposed.
Patch Action
Apply the kernel or product patch listed in SAP Note 3765424. Disabling HTTP/2 temporarily reduces exposure but is not a fix.
Affected Versions
Kernel 7.73+ (HTTP/2 on by default); 7.53/7.54 and HANA XS only if HTTP/2 is enabled. Java not affected.
Patch Info