CVE-2026-27690: SAP Approuter Vulnerable to HTTP Request Smuggling

July 14, 2026 (updated September 1, 2026)

Due to an HTTP Request Smuggling vulnerability in SAP Approuter, an unauthenticated attacker could send a specially crafted HTTP request that leads to request-response desynchronization. This could result in the exposure of user responses and cause the system to become unavailable. This leads to a high impact on confidentiality and availability.

References

github.com/advisories/GHSA-8m85-wqg7-c529
me.sap.com/notes/3720138
nvd.nist.gov/vuln/detail/CVE-2026-27690
url.sap/sapsecuritypatchday

Code Behaviors & Features

Detect and mitigate CVE-2026-27690 with GitLab Dependency Scanning

Secure your software supply chain by verifying that all open source dependencies used in your projects contain no disclosed vulnerabilities. Learn more about Dependency Scanning →