GitHub Advisoryadvisory · Maven

GHSA-3hw2-h67c-wq66 Uncontrolled Recursion in Akka HTTP

HIGH Published 2022-05-24 Modified 2025-09-30 Official page ↗
Aliases
CVE-2021-42697
Ecosystem
Maven
Packages
com.typesafe.akka:akka-http-core_2.13.0-RC3, com.typesafe.akka:akka-http-core_2.13.0-RC2, com.typesafe.akka:akka-http-core_2.13.0-M5, com.typesafe.akka:aakka-http-core_2.13.0-M3, com.typesafe.akka:akka-http-core_2.13, com.typesafe.akka:akka-http-core_2.12, com.typesafe.akka:akka-http-core_2.11
Severity
High
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Weaknesses
CWE-674, CWE-787
Reviewed
2022-06-21

Affected packages

• Maven com.typesafe.akka:akka-http-core_2.13.0-RC3: < 10.1.15 (no fix yet) • Maven com.typesafe.akka:akka-http-core_2.13.0-RC2: < 10.1.15 (no fix yet) • Maven com.typesafe.akka:akka-http-core_2.13.0-M5: < 10.1.15 (no fix yet) • Maven com.typesafe.akka:aakka-http-core_2.13.0-M3: < 10.1.15 (no fix yet) • Maven com.typesafe.akka:akka-http-core_2.13: >= 10.1.0, < 10.1.15 → fixed in 10.1.15 • Maven com.typesafe.akka:akka-http-core_2.13: >= 10.2.0-M1, < 10.2.7 → fixed in 10.2.7 • Maven com.typesafe.akka:akka-http-core_2.12: >= 10.1.0, < 10.1.15 → fixed in 10.1.15 • Maven com.typesafe.akka:akka-http-core_2.12: >= 10.2.0-M1, < 10.2.7 → fixed in 10.2.7 • Maven com.typesafe.akka:akka-http-core_2.11: >= 10.1.0, < 10.1.15 → fixed in 10.1.15

Description

Akka HTTP 10.1.x and 10.2.x before 10.2.7 can encounter stack exhaustion while parsing HTTP headers, which allows a remote attacker to conduct a Denial of Service attack by sending a User-Agent header with deeply nested comments.

Related

Alias · CVE (1)

  • CVE-2021-42697 Akka HTTP 10.1.x before 10.1.15 and 10.2.x before 10.2.7 can encounter stack exhaustion while parsing HTTP headers, which allows a remote… vulnerability

Weakness · CWE (2)

  • CWE-674 Uncontrolled Recursion weakness
  • CWE-787 Out-of-bounds Write weakness

References