CVE-2026-27690

HTTP Request Smuggling in SAP Approuter

View on CVE.org
Published Jul 14, 2026 CVSS 3.1 · 9.1 Critical EPSS < 1% KEV · Not listed
Description
Due to an HTTP Request Smuggling vulnerability in SAP Approuter, an unauthenticated attacker could send a specially crafted HTTP request that leads to request-response desynchronization. This could result in the exposure of user responses and cause the system to become unavailable. This leads to a high impact on confidentiality and availability.

Analysis

AI-generated

Technical impact

The vulnerability arises from HTTP request smuggling in SAP Approuter. An unauthenticated attacker can send a specially crafted HTTP request that induces request‑response desynchronization. This can expose user responses, compromising confidentiality, and disrupt normal operation, raising availability concerns.

Affected Systems

SAP Approuter components provided by SAP SE. No specific version range is detailed in the advisory.

Risk and Exploitability

CVSS score of 9.1 indicates very high severity. EPSS < 1% suggests low current exploitation probability. The issue is not listed in CISA KEV, so active exploitation risk depends on the presence of unauthenticated interfaces. The flaw can be exploited over the network via standard HTTP, requiring no authentication.

Remediation

No solution or workaround provided in the CVE record.

OpenCVE Recommended Actions

  • Apply the official SAP patch described in SAP Note 3720138.
  • Reconfigure the Approuter to enforce strict RFC‑7230 compliant request parsing and reject ambiguous pipelined requests.
  • Deploy traffic monitoring to detect and alert on suspicious request patterns that could indicate smuggling attempts.

Generated by OpenCVE AI on July 31, 2026 at 10:57 UTC.

Tracking

Sign in to view the affected projects.

Advisories

Source ID Title
Github GHSA Github GHSA GHSA-8m85-wqg7-c529 SAP Approuter Vulnerable to HTTP Request Smuggling
History
Type Values Removed Values Added
First Time appeared Sap
Sap approuter
CPEs cpe:2.3:a:sap:approuter:*:*:*:*:*:node.js:*:*
Vendors & Products Sap
Sap approuter
Type Values Removed Values Added
First Time appeared Sap Se
Sap Se sap Approuter
Vendors & Products Sap Se
Sap Se sap Approuter
Type Values Removed Values Added
Metrics ssvc

{'options': {'Automatable': 'yes', 'Exploitation': 'none', 'Technical Impact': 'total'}, 'version': '2.0.3'}
Type Values Removed Values Added
Description Due to an HTTP Request Smuggling vulnerability in SAP Approuter, an unauthenticated attacker could send a specially crafted HTTP request that leads to request-response desynchronization. This could result in the exposure of user responses and cause the system to become unavailable. This leads to a high impact on confidentiality and availability.
Title HTTP Request Smuggling in SAP Approuter
Weaknesses CWE-444
References
Metrics cvssV3_1

{'score': 9.1, 'vector': 'CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:H'}
Weaknesses
  • CWE-444

    Inconsistent Interpretation of HTTP Requests ('HTTP Request/Response Smuggling')

Sources

Status
PUBLISHED
Assigner
sap
Published
Updated
Jul 14, 2026, 12:46 PM
Reserved
Feb 23, 2026, 5:50 PM

View source JSON

Updated
Jul 14, 2026, 12:45 PM

JSON

Status
Analyzed
Published
Jul 14, 2026, 1:16 AM
Modified
Oct 24, 2026, 10:10 PM

View source JSON

No data.

Updated
Jul 31, 2026, 11:00 AM

JSON