CVE-2025-42930

SAP Business Planning and Consolidation allows an authenticated standard user to call a function module by crafting specific parameters that causes a loop, consuming excessive resources and resulting in system unavailability. This leads to high impact on the availability of the application, there is no impact on confidentiality or integrity.

Scoring

Severity

MEDIUM

CVSS base score

6.5

CVSS vector

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H

EPSS probability

0.32%

CWE

CWE-606

Published

2025-09-09

Last modified

2026-03-13

Affected products

• SAP_SE SAP Business Planning and Consolidation
• SAP_SE SAP Business Planning and Consolidation
• SAP_SE SAP Business Planning and Consolidation
• SAP_SE SAP Business Planning and Consolidation
• SAP_SE SAP Business Planning and Consolidation
• SAP_SE SAP Business Planning and Consolidation
• SAP_SE SAP Business Planning and Consolidation
• SAP_SE SAP Business Planning and Consolidation

Weakness type

• CWE-606

Related vulnerabilities

• CVE-2026-85730 — smol-toml: Denial of Service via malformed TOML documents
• CVE-2026-13761 — Pega Platform versions 7.1.0 through 25.1.2 are affected by an improper validation of inputs that are used for loop conditions, potentially leading to a denial of service or other consequences because of excessive looping.
• CVE-2026-16599 — Denial of Service in GNU wget
• CVE-2026-62901 — .NET Denial of Service Vulnerability
• CVE-2026-71439 — Mermaid radar diagrams are vulnerable to DoS
• CVE-2026-20301 — Cisco IOS Software and IOS XE Software Extensible Messaging Client Protocol Denial of Service Vulnerability
• CVE-2026-67554 — Apache Qpid Proton Dotnet: Unbounded disposition range handling can lead to denial of service
• CVE-2026-68077 — Apache Qpid Broker-J: Unbounded disposition range handling can lead to denial of service

Markdown version · Browse all CVEs