Skip to content
Fencer Vulns
high 7.5

CVE-2021-33670 json

SAP NetWeaver AS for Java (Http Service Monitoring Filter), versions - 7.10, 7.11, 7.20, 7.30, 7.31, 7.40, 7.50, allows an attacker to send…

published 2021-07-14 5 y ago modified 2026-06-17 4 mo ago also EUVD-2021-20347

cvss
7.5
version 3.0, CNA
cisa kev
Not listed
not in CISA's catalog
epss
3.2%
EPSS 3.2% chance of exploitation in 30 days, percentile 88%
public exploits
0
none known

Summary

SAP NetWeaver AS for Java (Http Service Monitoring Filter), versions - 7.10, 7.11, 7.20, 7.30, 7.31, 7.40, 7.50, allows an attacker to send multiple HTTP requests with different method types thereby crashing the filter and making the HTTP server unavailable to other legitimate users leading to denial of service vulnerability.

Patch / fix

Vendor advisories

What the vendors themselves say about their products: affected, fixed or not affected, and what to do.

red hat product security vex CVE-2021-33670 updated cvss 7.5

SAP-NetWeaver: Denial of Service in SAP NetWeaver JAVA

  • Red Hat build of Quarkus SAP-NetWeaver SAP-NetWeaver Red Hat Fuse 7 SAP-NetWeaver SAP-NetWeaver Red Hat Integration Camel K 1 SAP-NetWeaver SAP-NetWeaver Red Hat Integration Camel Quarkus 1 SAP-NetWeaver SAP-NetWeaver Red Hat Integration Data Virtualisation Operator SAP-NetWeaver SAP-NetWeaver Red Hat JBoss Fuse 6 SAP-NetWeaver SAP-NetWeaver
    +1 more products
    Red Hat JBoss Fuse Service Works 6 SAP-NetWeaver SAP-NetWeaver
    not affected: vulnerable code not present

Red Hat CSAF VEX © Red Hat, Inc., from https://security.access.redhat.com/data/csaf/v2/vex/; changed: reduced to product statuses and remediations. CC BY 4.0 · csaf

Exploit prediction

3.16% chance of exploitation in the next 30 days, higher than 88% of all scored CVEs (FIRST EPSS, 2026-11-08).

CVSS scores

assigned by version score vector
CNA 3.0 7.5 CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
NVD 3.1 7.5 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
NVD 2.0 5.0 AV:N/AC:L/Au:N/C:N/I:N/A:P

Affected products

  • SAP SE SAP NetWeaver AS for Java (Http Service)

References

Sources

Fencer Vulns keeps one entry per vulnerability: the CVE id wins, then GHSA, and records that alias each other are merged, except that two CVEs always keep separate entries. The same data is available as JSON.