Vulnerability · Published Dec 9, 2025 · Assigned by sap

CVE-2025-42873Denial of Service (DoS) in SAPUI5 framework (Markdown-it component)

Medium 5.9

In plain English

A medium-severity security flaw in SAPUI5 framework (Markdown-it component) from SAP_SE. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.4% (higher than 32% of all known vulnerabilities).

Severity (CVSS 3.1)5.9Medium

Exploit odds (30 days)0.4%top 67.8% of all CVEs

Exploited in the wildNo reportsCISA SSVC: none

Attack toolingNoneno public tooling known

Official description

SAPUI5 (and OpenUI5) packages use outdated 3rd party libraries with known security vulnerabilities. When markdown-it encounters special malformed input, it fails to terminate properly, resulting in an infinite loop. This Denial of Service via infinite loop causes high CPU usage and system unresponsiveness due to a blocked processing thread. This vulnerability has no impact on confidentiality or integrity but has a high impact on system availability.

Affected products (as reported)

Vendor	Product	Versions
SAP_SE	SAPUI5 framework (Markdown-it component)	SAP_UI 755756757758

Weakness: CWE-405 · Vector: CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H

In plain English

Official description

Affected products (as reported)

References