Read the docs
TI-2022-06818 Aliases CVE-2022-22543GHSA-rmj9-w393-hxwf

Uncontrolled resource consumption in SAP NetWeaver Application Server for ABAP and ABAP…

Priority LOW 36CWE-400Published · Updated

Key facts

Attack vector
Network
Privileges required
None
User interaction
None
Attack complexity
Low
Impact type
Denial of service
Confidentiality · integrity · availability
None · None · High
Fix status
No fix listed

Attack profile from CVSS 3.1 · NVD. Fix status from CNA. Impact type from CWE-400.

Summary

SAP NetWeaver Application Server for ABAP (Kernel) and ABAP Platform (Kernel) - versions KERNEL 7.22, 8.04, 7.49, 7.53, 7.77, 7.81, 7.85, 7.86, 7.87, KRNL64UC 8.04, 7.22, 7.22EXT, 7.49, 7.53, KRNL64NUC 7.22, 7.22EXT, 7.49, does not sufficiently validate sap-passport information, which could lead to a Denial-of-Service attack. This allows an unauthorized remote user to provoke a breakdown of the SAP Web Dispatcher or Kernel work process. The crashed process can be restarted immediately, other processes are not affected.

Why it matters now

EPSS 0.01361 71st percentileScored 2026-11-07
Fix No fix listed No fixed version in the sources yet

SSVC decision points

Not available: CISA has not published SSVC decision points for this record.

Affected products

VendorProductAffected versionsFixed inStatusSource
SAPSAP NetWeaver Application Server for ABAP (Kernel) and ABAP Platform (Kernel)KERNEL 7.22; 8.04; 7.49; 7.53; 7.77; 7.81; 7.85; 7.86; 7.87; KRNL64UC 8.04; 7.22; 7.22EXT; KRNL64NUC 7.22—No fix listedCNA
  • SAP NetWeaver Application Server for ABAP (Kernel) and ABAP Platform (Kernel) VendorSAP Affected KERNEL 7.22; 8.04; 7.49; 7.53; 7.77; 7.81; 7.85; 7.86; 7.87; KRNL64UC 8.04; 7.22; 7.22EXT; KRNL64NUC 7.22 Fixed in — No fix listed CNA

CPE configurations NVD · 24

CPEVersionsRoleVendor
cpe:2.3:a:sap:netweaver_abap:7.22:*:*:*:*:*:*:*7.22VulnerableSAP
cpe:2.3:a:sap:netweaver_abap:7.22ext:*:*:*:*:*:*:*7.22extVulnerableSAP
cpe:2.3:a:sap:netweaver_abap:7.49:*:*:*:*:*:*:*7.49VulnerableSAP
cpe:2.3:a:sap:netweaver_abap:7.53:*:*:*:*:*:*:*7.53VulnerableSAP
cpe:2.3:a:sap:netweaver_abap:7.77:*:*:*:*:*:*:*7.77VulnerableSAP
cpe:2.3:a:sap:netweaver_abap:7.81:*:*:*:*:*:*:*7.81VulnerableSAP
cpe:2.3:a:sap:netweaver_abap:7.85:*:*:*:*:*:*:*7.85VulnerableSAP
cpe:2.3:a:sap:netweaver_abap:7.86:*:*:*:*:*:*:*7.86VulnerableSAP
cpe:2.3:a:sap:netweaver_abap:7.87:*:*:*:*:*:*:*7.87VulnerableSAP
cpe:2.3:a:sap:netweaver_abap:8.04:*:*:*:*:*:*:*8.04VulnerableSAP
  • cpe:2.3:a:sap:netweaver_abap:7.22:*:*:*:*:*:*:* Versions 7.22 Vulnerable ·SAP
  • cpe:2.3:a:sap:netweaver_abap:7.22ext:*:*:*:*:*:*:* Versions 7.22ext Vulnerable ·SAP
  • cpe:2.3:a:sap:netweaver_abap:7.49:*:*:*:*:*:*:* Versions 7.49 Vulnerable ·SAP
  • cpe:2.3:a:sap:netweaver_abap:7.53:*:*:*:*:*:*:* Versions 7.53 Vulnerable ·SAP
  • cpe:2.3:a:sap:netweaver_abap:7.77:*:*:*:*:*:*:* Versions 7.77 Vulnerable ·SAP
  • cpe:2.3:a:sap:netweaver_abap:7.81:*:*:*:*:*:*:* Versions 7.81 Vulnerable ·SAP
  • cpe:2.3:a:sap:netweaver_abap:7.85:*:*:*:*:*:*:* Versions 7.85 Vulnerable ·SAP
  • cpe:2.3:a:sap:netweaver_abap:7.86:*:*:*:*:*:*:* Versions 7.86 Vulnerable ·SAP
  • cpe:2.3:a:sap:netweaver_abap:7.87:*:*:*:*:*:*:* Versions 7.87 Vulnerable ·SAP
  • cpe:2.3:a:sap:netweaver_abap:8.04:*:*:*:*:*:*:* Versions 8.04 Vulnerable ·SAP
Show 14 more CPE
CPEVersionsRoleVendor
cpe:2.3:a:sap:netweaver_abap:krnl64nuc_7.22:*:*:*:*:*:*:*krnl64nuc_7.22VulnerableSAP
cpe:2.3:a:sap:netweaver_abap:krnl64nuc_8.04:*:*:*:*:*:*:*krnl64nuc_8.04VulnerableSAP
cpe:2.3:a:sap:netweaver_as_abap:7.22:*:*:*:*:*:*:*7.22VulnerableSAP
cpe:2.3:a:sap:netweaver_as_abap:7.22ext:*:*:*:*:*:*:*7.22extVulnerableSAP
cpe:2.3:a:sap:netweaver_as_abap:7.49:*:*:*:*:*:*:*7.49VulnerableSAP
cpe:2.3:a:sap:netweaver_as_abap:7.53:*:*:*:*:*:*:*7.53VulnerableSAP
cpe:2.3:a:sap:netweaver_as_abap:7.77:*:*:*:*:*:*:*7.77VulnerableSAP
cpe:2.3:a:sap:netweaver_as_abap:7.81:*:*:*:*:*:*:*7.81VulnerableSAP
cpe:2.3:a:sap:netweaver_as_abap:7.85:*:*:*:*:*:*:*7.85VulnerableSAP
cpe:2.3:a:sap:netweaver_as_abap:7.86:*:*:*:*:*:*:*7.86VulnerableSAP
cpe:2.3:a:sap:netweaver_as_abap:7.87:*:*:*:*:*:*:*7.87VulnerableSAP
cpe:2.3:a:sap:netweaver_as_abap:8.04:*:*:*:*:*:*:*8.04VulnerableSAP
cpe:2.3:a:sap:netweaver_as_abap:krnl64nuc_7.22:*:*:*:*:*:*:*krnl64nuc_7.22VulnerableSAP
cpe:2.3:a:sap:netweaver_as_abap:krnl64nuc_8.04:*:*:*:*:*:*:*krnl64nuc_8.04VulnerableSAP
  • cpe:2.3:a:sap:netweaver_abap:krnl64nuc_7.22:*:*:*:*:*:*:* Versions krnl64nuc_7.22 Vulnerable ·SAP
  • cpe:2.3:a:sap:netweaver_abap:krnl64nuc_8.04:*:*:*:*:*:*:* Versions krnl64nuc_8.04 Vulnerable ·SAP
  • cpe:2.3:a:sap:netweaver_as_abap:7.22:*:*:*:*:*:*:* Versions 7.22 Vulnerable ·SAP
  • cpe:2.3:a:sap:netweaver_as_abap:7.22ext:*:*:*:*:*:*:* Versions 7.22ext Vulnerable ·SAP
  • cpe:2.3:a:sap:netweaver_as_abap:7.49:*:*:*:*:*:*:* Versions 7.49 Vulnerable ·SAP
  • cpe:2.3:a:sap:netweaver_as_abap:7.53:*:*:*:*:*:*:* Versions 7.53 Vulnerable ·SAP
  • cpe:2.3:a:sap:netweaver_as_abap:7.77:*:*:*:*:*:*:* Versions 7.77 Vulnerable ·SAP
  • cpe:2.3:a:sap:netweaver_as_abap:7.81:*:*:*:*:*:*:* Versions 7.81 Vulnerable ·SAP
  • cpe:2.3:a:sap:netweaver_as_abap:7.85:*:*:*:*:*:*:* Versions 7.85 Vulnerable ·SAP
  • cpe:2.3:a:sap:netweaver_as_abap:7.86:*:*:*:*:*:*:* Versions 7.86 Vulnerable ·SAP
  • cpe:2.3:a:sap:netweaver_as_abap:7.87:*:*:*:*:*:*:* Versions 7.87 Vulnerable ·SAP
  • cpe:2.3:a:sap:netweaver_as_abap:8.04:*:*:*:*:*:*:* Versions 8.04 Vulnerable ·SAP
  • cpe:2.3:a:sap:netweaver_as_abap:krnl64nuc_7.22:*:*:*:*:*:*:* Versions krnl64nuc_7.22 Vulnerable ·SAP
  • cpe:2.3:a:sap:netweaver_as_abap:krnl64nuc_8.04:*:*:*:*:*:*:* Versions krnl64nuc_8.04 Vulnerable ·SAP

Remediation

No fixed version listed by the sources yet.

Timeline

  1. 2026-10-02 Threatist record created from CVE-2022-22543
  2. 2026-10-03 Alias added: GHSA-rmj9-w393-hxwf

References

Advisory 2

  • TI-2012-03697 Multiple stack-based buffer overflows in msg_server.exe in SAP NetWeaver ABAP 7.x allow… CVSS 2.0HIGH 10.0
  • TI-2021-09062 Improper authentication in SAP NetWeaver AS ABAP and ABAP Platform CVSS 3.1CRITICAL 9.8
  • TI-2021-15856 The software logistics system of SAP NetWeaver AS ABAP and ABAP Platform versions - 700… CVSS 3.1HIGH 8.8
  • TI-2021-09085 Out-of-bounds write in SAP NetWeaver AS for ABAP CVSS 3.1HIGH 7.5
  • TI-2021-09049 Out-of-bounds read in SAP NetWeaver AS for ABAP CVSS 3.1HIGH 7.5
  • TI-2021-15859 SAP NetWeaver AS ABAP and ABAP Platform - versions 700, 701, 702, 730, 731, 740, 750… CVSS 3.1HIGH 7.5
See all 20 →

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences