CVE-2025-42873: Denial of Service (DoS) in SAPUI5 framework (Markdown-it component)
SAPUI5 (and OpenUI5) packages use outdated 3rd party libraries with known security vulnerabilities. When markdown-it encounters special malformed input, it fails to terminate properly, resulting in an infinite loop. This Denial of Service via infinite loop causes high CPU usage and system unresponsiveness due to a blocked processing thread. This vulnerability has no impact on confidentiality or integrity but has a high impact on system availability.
Affected Software
Event History
Frequently Asked Questions
What is the severity of CVE-2025-42873?
CVE-2025-42873 has been classified with a high severity due to its potential to lead to a Denial of Service attack through infinite loops.
How do I fix CVE-2025-42873?
To remediate CVE-2025-42873, update the affected SAPUI5 and OpenUI5 packages to versions that include patched third-party libraries.
What systems are affected by CVE-2025-42873?
CVE-2025-42873 affects systems that utilize SAPUI5 and OpenUI5, specifically those using the markdown-it library.
What kind of attack does CVE-2025-42873 enable?
CVE-2025-42873 enables a Denial of Service attack that results in excessive CPU usage due to an infinite loop triggered by malformed input.
How does CVE-2025-42873 impact application performance?
CVE-2025-42873 negatively impacts application performance by causing high CPU usage and unresponsiveness due to the denial of service condition.