CVE-2025-42873 Details
Description
SAPUI5 (and OpenUI5) packages use outdated 3rd party libraries with known security vulnerabilities. When markdown-it encounters special malformed input, it fails to terminate properly, resulting in an infinite loop. This Denial of Service via infinite loop causes high CPU usage and system unresponsiveness due to a blocked processing thread. This vulnerability has no impact on confidentiality or integrity but has a high impact on system availability.
A denial-of-service vulnerability has been identified in SAPUI5 and OpenUI5 packages that utilize an outdated version of the markdown-it library, which contains known security flaws. The issue arises when markdown-it processes certain specially crafted input, leading to improper termination and causing an infinite loop. This loop results in excessive CPU consumption and unresponsiveness, as a processing thread becomes blocked. While the vulnerability does not affect confidentiality or integrity, it significantly disrupts system availability.
Users are advised to consult the SAP Security Notes for guidance on addressing this vulnerability. SAP Security Notes can be accessed through the SAP for Me platform, where users can find the complete list of security updates and patches. For specific patching instructions, refer to the SAP Security Notes FAQs.
Metrics
CVSS 4.0 Severity and Vector Strings:
VolerionCVSS 3.x Severity and Vector Strings:
No data available for CVSS Version 2.0 on this CVE.
Volerion
Assessed Dec 9, 2025CISA-ADP
Assessed Dec 9, 2025References to Advisories, Solutions, and Tools
By selecting these links, you will be leaving this site. These are references gathered from the official CVE record and are not endorsed by Volerion.
| URL | Source(s) | Tag(s) |
|---|---|---|
| https://me.sap.com/notes/3676970 | [email protected] | Permission RequiredVendor |
| https://url.sap/sapsecuritypatchday | [email protected] | AdvisoryVendor |
Weakness Enumeration
| CWE-ID | CWE Name | Source |
|---|---|---|
| CWE-405 | Asymmetric Resource Consumption (Amplification) | [email protected] |
Affected Products
| Product | Versions |
|---|---|
| SAPUI5 | All versions |
CPE
Remediation
| |
| OpenUI5 | All versions |
CPE
Remediation
| |
Change History
3 change records found show changes
| Date | Action | Recorded By |
|---|---|---|
| Jun 17, 2026 | CVE Modified | [email protected] |
| Jun 17, 2026 | CVE Modified | CISA-ADP |
| Dec 9, 2025 | New CVE Received | [email protected] |