Medium severity6.5NVD Advisory· Published Apr 10, 2017· Updated Jun 17, 2026

CVE-2016-10304

Description

The SAP EP-RUNTIME component in SAP NetWeaver AS JAVA 7.5 allows remote authenticated users to cause a denial of service (out-of-memory error and service instability) via a crafted serialized Java object, as demonstrated by serial.cc3, aka SAP Security Note 2315788.

Affected products

SAP/Netweaver Application Server Java
cpe:2.3:a:sap:netweaver_application_server_java:7.50:*:*:*:*:*:*:*
SAP/EP-RUNTIMEllm-create
Range: 7.5
SAP/Netweaver As Javallm-fuzzy
Range: 7.5

Patches

Vulnerability mechanics

References

erpscan.io/advisories/erpscan-16-029-sap-netweaver-java-7-5-deserialization-untrusted-user-value-trustmanagementservlet/nvdThird Party Advisory

News mentions

No linked articles in our index yet.

cvss	0.423
epss	0.001
exploit	0.000
kev	0.000
patch	0.000
ransomware	0.000