ICM Brotli Resource Exhaustion: CVE-2026-109794 · CVSS 3.0 7.5 · SAP Note 3805681
Note 3805681 fixes uncontrolled resource consumption in the AS ABAP ICM, ABAP Platform and SAP Web Dispatcher. The problem occurs when they process certain requests. An unauthenticated attacker can send requests that tie up resources until service degrades or stops. SAP rates the ICM Brotli Resource Exhaustion at CVSS 7.5, High. The workaround, in fact, points to Brotli decompression as the trigger. In this post, we cover exposure, the fix and what to check.
ICM Brotli Resource Exhaustion: affected releases
This issue affects Web Dispatcher and kernel 7.77, 7.93 and 9.16, as well as HANA XS Advanced runtime 1.00. In contrast, AS Java and the HANA XS Classic Web Dispatcher are not on the list. XSA needs version 1.5.5 or later (Note 3835748).
Workaround
Set ict/disable_brotli = TRUE in the instance or DEFAULT profile. Then restart the Web Dispatcher and all application servers. GZIP compression keeps working, so users mostly see slightly larger responses. For that reason, this is one of the few November workarounds that is cheap to apply against this issue.
What to do
Patch via SAPWEBDISP.SAR, dw.sar or the SP Stack Kernel. If the patch cannot go in this week, apply the workaround on internet-facing Web Dispatchers first. Afterwards, remove the workaround only once every instance runs the fixed kernel, so the ICM Brotli Resource Exhaustion stays closed.
What to check
Search all instance profiles for the parameter, so you know where the workaround is active. In addition, record it as a temporary change. Otherwise, the ICM Brotli Resource Exhaustion workaround tends to stay in place for years without anyone remembering why.
ICM Brotli Resource Exhaustion: advisory details
Component: BC-CST-IC
SAP priority: High
First release: 10.11.2026
Reviewed release: 10 November 2026, note version 3
CVSS vector: CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Source: SAP Security Note 3805681 (SAP for Me; sign-in needed). The patch and workaround details above reflect the version we reviewed on 10 November 2026. However, SAP sometimes updates notes after release, so check the current note before you plan.
Read the full SAP Security Patch Day November 2026 overview.
