Uncontrolled Recursion in Akka HTTP

HIGH 7.5CVE-2021-42697 · GHSA-3hw2-h67c-wq66 · Published 02/11/2021 · updated 17/06/2026

Package	Affected versions	Patched versions
com.typesafe.akka:aakka-http-core_2.13.0-M3 Maven	`≥ 10.1.0`	No fix yet
com.typesafe.akka:akka-http-core_2.11 Maven	`≥ 10.1.0, < 10.1.15`	`10.1.15`
com.typesafe.akka:akka-http-core_2.12 Maven	`≥ 10.1.0, < 10.1.15≥ 10.2.0-M1, < 10.2.7`	`10.1.1510.2.7`
com.typesafe.akka:akka-http-core_2.13 Maven	`≥ 10.1.0, < 10.1.15≥ 10.2.0-M1, < 10.2.7`	`10.1.1510.2.7`
com.typesafe.akka:akka-http-core_2.13.0-M5 Maven	`≥ 10.1.0`	No fix yet
com.typesafe.akka:akka-http-core_2.13.0-RC2 Maven	`≥ 10.1.0`	No fix yet
com.typesafe.akka:akka-http-core_2.13.0-RC3 Maven	`≥ 10.1.0`	No fix yet
http server akka	`≥ 10.1.0, < 10.1.15≥ 10.2.0, < 10.2.7`	`10.1.1510.2.7`

Description

Akka HTTP 10.1.x and 10.2.x before 10.2.7 can encounter stack exhaustion while parsing HTTP headers, which allows a remote attacker to conduct a Denial of Service attack by sending a User-Agent header with deeply nested comments.

NVD description

Akka HTTP 10.1.x before 10.1.15 and 10.2.x before 10.2.7 can encounter stack exhaustion while parsing HTTP headers, which allows a remote attacker to conduct a Denial of Service attack by sending a User-Agent header with deeply nested comments.

References

nvd.nist.gov/vuln/detail/CVE-2021-42697 · ADVISORY
akka/akka-http#3924 · WEB
akka.io/blog · WEB
akka.io/blog/news/2021/11/02/akka-http-10.2.7-released · WEB
akka.io/blog/news/2021/11/22/akka-http-10.1.15-released · WEB
doc.akka.io/docs/akka-http/current/security/2021-CVE-2021-42697-stack-overflow-parsing-user-agent.html · WEB
akka/akka-http · PACKAGE
packetstormsecurity.com/files/167018/Akka-HTTP-10.1.14-Denial-Of-Service.html · WEB
akka.io/blog · Vendor Advisory

Running one of these products? Scan your site to see whether it exposes a vulnerable version.

Scan my site free