GitHub Advisoryadvisory · Maven

GHSA-2w7w-2j92-44hx HTTP Request Smuggling in akka-http-core

MEDIUM Published 2021-05-10 Modified 2021-03-19 Official page ↗
Aliases
CVE-2021-23339
Ecosystem
Maven
Packages
com.typesafe.akka:akka-http-core
Severity
Moderate
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N
Weaknesses
CWE-444
Reviewed
2021-03-19

Affected packages

• Maven com.typesafe.akka:akka-http-core: >= 10.2.0, < 10.2.4 → fixed in 10.2.4 • Maven com.typesafe.akka:akka-http-core: < 10.1.14 → fixed in 10.1.14

Description

A vulnerable Akka HTTP server will accept a malformed message and hand it over to the user. If the user application proxies this message to another server unchanged and that server also accepts that message but interprets it as two HTTP messages, the second message has reached the second server without having been inspected by the proxy.

Related

Alias · CVE (1)

  • CVE-2021-23339 This affects all versions before 10.1.14 and from 10.2.0 to 10.2.4 of package com.typesafe.akka:akka-http-core. vulnerability

Weakness · CWE (1)

  • CWE-444 Inconsistent Interpretation of HTTP Requests weakness

References