Advisory
SAP takes the security of its vast product portfolio very seriously and thus releases security fixes for
vulnerabilities reported by external researchers and their customers every second Tuesday of the month.
SAP Note 3664466
was released on
14.10.2025 and deals with
"[CVE-2025-5115] Denial of service (DOS) in SAP Commerce Cloud (Search and Navigation)" within SAP Commerce Cloud.
We advice you to follow the instructions, to resolve
denial of service (dos)
with a
high potential for exploitation
in component CEC-SCC-COM-SRC-SER.
According to SAP Security Advisory team a workaround does not exist. It is advisable to implement the correction as monthly patch process.
Denial of Service (DoS) attacks that take a system offline may lead to significant cost for the company, studies quantify the costs in average between 4 and 5 millions dollars. Business continuity requires SAP systems staying online. The CVSS scores or vulnerability descriptions are not enough to represent how a simple bug can lead to a significant loss for companies.
Risk specification
This note has been re-released with updated 'Symptom', 'Reason and Prerequisites' and 'Solution' section. SAP Commerce Cloud Search and Navigation allow an unauthenticated attacker to send maliciously crafted requests, resulting in a reset of HTTP/2 streams and excessive consumption of resources on the server side.
Solution
SAP Commerce Cloud resolves this vulnerability by upgrading the Jetty http2-common library to the latest version.
