CVE-2026-66761: SAP Approuter DoS Vulnerability

CVE-2026-66761 Overview

CVE-2026-66761 is a flow control weakness in SAP Approuter that enables authenticated attackers to trigger unbounded memory growth. An attacker with low privileges can send high volumes of data without consuming the corresponding responses, causing the server process to accumulate memory without bound. The condition maps to [CWE-770] (Allocation of Resources Without Limits or Throttling) and produces a limited availability impact. Confidentiality and integrity are not affected. SAP addressed the issue as part of its Security Patch Day disclosures.

Critical Impact
Authenticated attackers can cause memory exhaustion in SAP Approuter, degrading availability of routed applications and back-end services.

Affected Products

SAP Approuter (see SAP Note 3786038 for affected versions)

Discovery Timeline

2026-08-11 - CVE-2026-66761 published to NVD
2026-08-11 - Last updated in NVD database

Technical Details for CVE-2026-66761

Vulnerability Analysis

SAP Approuter acts as an entry point that routes HTTP traffic to business applications running on SAP BTP. The component fails to enforce sufficient flow control on certain request-processing paths. When a client transmits large volumes of data but never reads the responses returned by the server, the server-side buffers and associated allocations continue to grow.

The underlying cause is missing back-pressure between the transport layer and the application layer. Without upper bounds on queued data or per-connection memory, the process retains buffers for pending writes to unresponsive clients. An attacker with valid low-privilege credentials can maintain many such connections concurrently.

The impact is confined to availability. Memory pressure on the Approuter host can cause slowdowns, container restarts, or process termination. Confidentiality and integrity are not affected because no data is exposed or altered.

Root Cause

The defect is a classic [CWE-770] pattern: allocation of resources without limits or throttling. Approuter accepts and buffers inbound data on connections whose response side is not being drained, and it does not cap the memory associated with those connections.

Attack Vector

The vulnerability is exploitable over the network with low attack complexity. The attacker must hold low-level privileges but does not require user interaction. Exploitation requires opening authenticated sessions to Approuter and streaming request data at a high rate while refusing to consume server responses. Repeating this across many concurrent connections amplifies memory consumption until the host degrades or the process is killed.

No verified public exploit code is available for CVE-2026-66761. See the SAP Note 3786038 and the SAP Security Patch Day advisory for vendor technical details.

Detection Methods for CVE-2026-66761

Indicators of Compromise

Sustained growth in resident memory of the Approuter process without a proportional increase in completed requests.
Large numbers of concurrent authenticated connections from a single principal or narrow IP range.
High volume of inbound bytes paired with near-zero outbound bytes consumed by the same client sessions.
Approuter container or process restarts triggered by out-of-memory conditions.

Detection Strategies

Correlate authentication logs with connection counts per user to flag low-privilege accounts holding abnormal numbers of open sessions.
Alert on Approuter memory utilization crossing baseline thresholds over rolling windows.
Inspect reverse-proxy or load-balancer telemetry for sessions where TCP receive windows on the client remain closed while the client keeps sending data.

Monitoring Recommendations

Enable resource metrics collection (memory, open sockets, event-loop lag) for every Approuter instance and forward to a central SIEM.
Track per-user request rates and byte volumes so anomalies from a single identity are visible.
Configure alerts on repeated OOM-kills or container restarts of the Approuter workload.

How to Mitigate CVE-2026-66761

Immediate Actions Required

Apply the fix referenced in SAP Note 3786038 to all Approuter deployments.
Inventory all Approuter instances across development, test, and production landscapes to confirm coverage.
Rotate or review credentials of low-privilege accounts that can reach Approuter endpoints from untrusted networks.

Patch Information

SAP published the fix as part of its Security Patch Day. Consult SAP Note 3786038 for the corrected Approuter versions and upgrade guidance, and the SAP Security Patch Day portal for the broader advisory bundle.

Workarounds

Place Approuter behind a reverse proxy or API gateway that enforces per-connection request size limits and idle-write timeouts.
Set container memory limits and configure orchestrators to restart Approuter on OOM to bound blast radius.
Restrict network exposure of Approuter so that only trusted client networks can initiate authenticated sessions.
Rate-limit authenticated requests per identity at the edge until patches are deployed.

bash

# Configuration example
# Refer to SAP Note 3786038 for the vendor-supplied configuration guidance.