CVE-2026-58249 · CVSS 3.0 7.5 · SAP Note 3765424
HTTP/2 configuration is the first check for SAP Note 3765424. A malformed request can crash a process in SAP’s HTTP/2 implementation, but an installation is affected only when HTTP/2 is supported and enabled. SAP rates the issue CVSS 7.5, with High priority and an availability impact.
Exposure extends beyond Web Dispatcher
The note covers ICM in NetWeaver/ABAP Platform, Web Dispatcher and relevant Content Server and HANA XS deployments. HTTP/2 is enabled by default for the listed NetWeaver/ABAP kernel and Web Dispatcher releases from 7.73 onward. In 7.53 and 7.54 deployments listed by SAP, exposure depends on explicitly enabling the parameter. SAP states that NetWeaver AS Java does not support HTTP/2 and is not affected. The attacker needs neither credentials nor another user’s interaction.
A crash vulnerability, with release-specific fixes
The title says memory corruption; the documented outcome is denial of service. SAP does not assign confidentiality or integrity impact. Select the correction from the note’s product and kernel patch matrix. Visible entries include kernel/Web Dispatcher 7.53 PL1612, 7.54 PL651 and 7.77 PL914. For 7.93, SAP lists both PL401 and PL417; use the package applicability in the current note rather than collapsing these into a single universal threshold. HANA XSC fixes include revisions 079.11 and 089.04; XSA requires 1.5.4 or higher.
Disabling HTTP/2 buys time
SAP documents icm/HTTP/support_http2=FALSE as a temporary workaround. Persistence and activation differ by product. Web Dispatcher and ABAP procedures can change the running value without a restart; the Content Server procedure requires a restart. HANA XS has its own configuration locations. Use the relevant procedure in the note. SAP expects no functional loss from disabling HTTP/2, although browser UI performance may decrease.
Check every reachable listener
Inventory direct routes as well as traffic through a front-end Web Dispatcher. SAP says a workaround at Web Dispatcher is sufficient only where the backend is accessed exclusively through it. After remediation, record the effective HTTP/2 setting or installed binary patch level on each affected instance. Use normal health checks and application requests to validate service; a deliberate crash test belongs outside production.
Advisory details
Component: BC-CST-IC
SAP priority: Correction with high priority
First release: 13.10.2026
Reviewed release: 13 October 2026, note version 8
CVSS vector: CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Source: SAP Security Note 3765424 (SAP for Me; sign-in may be required). The patch and workaround details above reflect the version reviewed on 13 October 2026. Check the current note for subsequent changes.
