High severity vulnerability that affects com.typesafe.akka:akka-http-core_2.11 and com.typesafe.akka:akka-http-core_2.12

Description

References

• nvd.nist.gov/vuln/detail/CVE-2018-16131 · ADVISORY
• akka/akka-http · WEB
• akka.io/blog/news/2018/08/30/akka-http-dos-vulnerability-found · WEB
• doc.akka.io/docs/akka-http/current/security/2018-09-05-denial-of-service-via-decodeRequest.html · WEB
• GitHub Advisory GHSA-9qgc-p27w-3hjg · ADVISORY
• groups.google.com/forum · WEB
• groups.google.com/forum

Weitere Schwachstellen in com.typesafe.akka:akka-http-core_2.11

• CVE-2023-44487HOCH 7.5EXPLOITED (CISA KEV)The HTTP/2 protocol allows a denial of service (server resource consumption) because request cancellation can reset many streams quickly, as…
• CVE-2021-42697HOCH 7.5Akka HTTP 10.1.x before 10.1.15 and 10.2.x before 10.2.7 can encounter stack exhaustion while parsing HTTP headers, which allows a remote at…
• CVE-2017-1000118HOCH 7.5Akka HTTP versions <= 10.0.5 Illegal Media Range in Accept Header Causes StackOverflowError Leading to Denial of Service