ICM and Web Dispatcher Header DoS: CVE-2026-109793 · CVSS 3.0 7.5 · SAP Note 3808627
Note 3808627 fixes an error in the component that parses certain inbound HTTP request headers. Specifically, it affects the AS ABAP ICM and SAP Web Dispatcher. A single crafted request from an unauthenticated attacker can make the process unavailable. SAP rates the ICM and Web Dispatcher Header DoS at CVSS 7.5, High. In this post, we cover exposure, the fix and what to check.
ICM and Web Dispatcher Header DoS: affected releases
This issue affects Web Dispatcher 9.16 and kernel 9.16, 9.20 and 9.21. Older kernels, in contrast, are not on the list. For standalone Web Dispatcher, use SAPWEBDISP.SAR (Note 908097). For the ICM and embedded Web Dispatcher, use dw.sar or the SP Stack Kernel.
What to do
There is no workaround for this issue. Since the Web Dispatcher is usually internet-facing, patch it first. Then combine the work with the other November Web Dispatcher notes (3778556, 3804858, 3803832, 3805681, 3782056) in a single rollout.
Why one request is enough
Many denial-of-service bugs need a flood of traffic, and rate limits can catch that. However, this attack needs only a single request. As a result, perimeter rate limiting does not help much here.
What to check
First, list all Web Dispatchers and ICM instances on kernel 9.16 or later. Next, check their patch level after the rollout. Finally, review the dev_icm and dev_webdisp traces for unexpected restarts, which can reveal attempts at this attack.
ICM and Web Dispatcher Header DoS: advisory details
Component: BC-CST-DP
SAP priority: High
First release: 10.11.2026
Reviewed release: 10 November 2026, note version 7
CVSS vector: CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Source: SAP Security Note 3808627 (SAP for Me; sign-in needed). The patch and workaround details above reflect the version we reviewed on 10 November 2026. However, SAP sometimes updates notes after release, so check the current note before you plan.
Read the full SAP Security Patch Day November 2026 overview.
