CVE-2025-42873
Medium
Description
SAPUI5 (and OpenUI5) packages use outdated 3rd party libraries with known security vulnerabilities. When markdown-it encounters special malformed input, it fails to terminate properly, resulting in an infinite loop. This Denial of Service via infinite loop causes high CPU usage and system unresponsiveness due to a blocked processing thread. This vulnerability has no impact on confidentiality or integrity but has a high impact on system availability.
SeverityMedium
CVSS5.9
Exploit probability—
ProductSAPUI5 framework (Markdown-it component)
PublishedDec 9, 2025
First seenDec 9, 2025
Weakness typeCWE-405CWE-405
How to fix
Sources list no fixed version or patch link for this vulnerability.
Affected products
| Product | Affected versions | Fixed in |
|---|---|---|
| SAP_SE SAPUI5 framework (Markdown-it component) | SAP_UI 755, 756, 757, 758 | — |
Check your version
Choose the product and enter the version you run to see whether it falls in the affected range.
In the Intelligence 360 plan
Attack Surface Management
See the assets tied to your domains, the technologies they run and known vulnerabilities in one list.