Advisory
SAP takes the security of its vast product portfolio very seriously and thus releases security fixes for
vulnerabilities reported by external researchers and their customers every second Tuesday of the month.
SAP Note 3664466
was released on
14.10.2025 and deals with
"[CVE-2025-5115] Denial of service (DOS) in SAP Commerce Cloud (Search and Navigation)" within SAP Commerce Cloud.
We advice you to follow the instructions, to resolve
denial of service (dos)
with a
high potential for exploitation
in component CEC-SCC-COM-SRC-SER.
According to SAP Security Advisory team a workaround does not exist. It is advisable to implement the correction as monthly patch process.
Denial of Service (DoS) attacks that take a system offline may lead to significant cost for the company, studies quantify the costs in average between 4 and 5 millions dollars. Business continuity requires SAP systems staying online. The CVSS scores or vulnerability descriptions are not enough to represent how a simple bug can lead to a significant loss for companies.
Risk specification
SAP Commerce Cloud Search and Navigation allow an unauthenticated attacker to send maliciously crafted requests, which may cause HTTP/2 stream resets and lead to excessive resource consumption on the server side.Solution
SAP Commerce Cloud resolves this vulnerability by upgrading the Jetty http2-common library to the latest available version.
- 9.8 Multiple vulnerabilities associated with Reprise License Manager 14.2 component used with SAP 3D Visual Enterprise License Manager
- 7.8 [CVE-2023-33990] Denial of service (DOS) vulnerability in SAP SQL Anywhere
- 7.7 [CVE-2023-35871] Memory Corruption vulnerability in SAP Web Dispatcher
- 7.5 Denial of service (DOS) in SAP Commerce
- 7.5 [CVE-2020-6186] Denial of Service (DOS) Vulnerability in SAP Host Agent
