CVE-2025-42873

MEDIUM EPSS 23.8%

Published Dec 9, 20256mo ago · Modified Jun 17, 20261w ago

5.9 CVSS 3.1

Medium

Published Dec 9, 2025 6mo ago

Last Modified Jun 17, 2026 1w ago

Description

SAPUI5 (and OpenUI5) packages use outdated 3rd party libraries with known security vulnerabilities. When markdown-it encounters special malformed input, it fails to terminate properly, resulting in an infinite loop. This Denial of Service via infinite loop causes high CPU usage and system unresponsiveness due to a blocked processing thread. This vulnerability has no impact on confidentiality or integrity but has a high impact on system availability.

CVSS Details

Base Score

5.9

Exploitability

2.2

Impact

3.6

Vector string

CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H

Attack Vector Network

Attack Complexity High

Privileges Required None

User Interaction None

Scope Unchanged

Confidentiality None

Integrity None

Availability High

Threat Intelligence

EPSS Exploit Probability

23.8% percentile

Exploit & Patch Status

No Known Exploit

No Patch Available

Weaknesses 1

CWE-405

References 2

me.sap.com https://me.sap.com/notes/3676970
url.sap https://url.sap/sapsecuritypatchday

Remediation

No remediation data recorded yet

Check vendor advisories and the NVD entry for patch availability.