CVE-2025-42978 (CVSS 3.5)

Description

The widely used component that establishes outbound TLS connections in SAP NetWeaver Application Server Java does not reliably match the hostname that is used for the connection against the wildcard hostname defined in the received certificate of remote TLS server. This might lead to the outbound connection being established to a possibly malicious remote TLS server and hence disclose information. Integrity and Availability are not impacted.

Is your site exposed to CVE-2025-42978?

Run a free security scan — no signup, results in seconds.

CVSS v3.1 Score

3.5

LOW

CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:L/I:N/A:N

Weakness Type (CWE)

CWE-940 CWE-940

References

Other References

https://me.sap.com/notes/3557179 https://url.sap/sapsecuritypatchday

Frequently Asked Questions

What is CVE-2025-42978? +

The widely used component that establishes outbound TLS connections in SAP NetWeaver Application Server Java does not reliably match the hostname that is used for the connection against the wildcard hostname defined in the received certificate of remote TLS server. This might lead to the outbound connection being established to a possibly malicious remote TLS server and hence disclose information. Integrity and Availability are not impacted. It has a CVSS v3.1 base score of 3.5 (LOW).

How severe is CVE-2025-42978? +

CVE-2025-42978 has a CVSS v3.1 score of 3.5 out of 10, rated LOW. This is a low-severity vulnerability with limited impact.

How do I check if I'm vulnerable to CVE-2025-42978? +

You can use Secably's free Website Scanner to check your website for known vulnerabilities. For infrastructure scanning, use the Port Scanner to identify exposed services that may be affected. Check the vendor advisories linked above for specific patch and version information.

Related Vulnerabilities

CVE-2026-59786

Zabbix Server and Proxy accept the active agent heartbeat message regardless of the configured PSK or certificate authentication. This means …

CVE-2025-9999

Some payload elements of the messages sent between two stations in a networking architecture are not properly checked on the …

CVE-2026-101897

Angular is a development platform for building mobile and desktop web applications using TypeScript/JavaScript and other languages. From 1.20.0 until …

CVE-2026-55660

Tina is a headless content management system. In versions prior to @tinacms/app 2.5.6 and tinacms 3.9.3, cross-origin postMessage handlers and …

CVE-2026-89409

In Z-Wave SDK 8.1.1 and earlier (for 700/800 series devices) and 6.85.02 and earlier (for 500 series devices), missing checks …

CVE-2026-66279

In Connect SDK 4.3.1 and earlier and Flex SDK 3.7.7 and earlier, a message with invalid security settings may bypass …

CVE-2025-42978