Akka Java Serialization vulnerability

ALTO 8.1CVE-2017-1000034 · GHSA-mm57-9j6q-rxm2 · Published 17/07/2017 · updated 17/06/2026

En resumen

CVE-2017-1000034 es una vulnerabilidad ALTO (CVSS 8.1) que afecta a com.typesafe.akka:akka-actor, akka (akka).
Probabilidad de explotación en los próximos 30 días (EPSS): 6.2%, mayor que el 93.5% de las vulnerabilidades.
Solución: actualizar a 2.4.17 o posterior.

Package	Affected versions	Patched versions
com.typesafe.akka:akka-actor Maven	`< 2.4.17`	`2.4.17`
akka akka	`= 2.5≤ 2.4.16`	No fix yet

Description

Akka versions <=2.4.16 and 2.5-M1 are vulnerable to a java deserialization attack in its Remoting component resulting in remote code execution in the context of the ActorSystem.

NVD description

Akka versions <=2.4.16 and 2.5-M1 are vulnerable to a java deserialization attack in its Remoting component resulting in remote code execution in the context of the ActorSystem.

References

nvd.nist.gov/vuln/detail/CVE-2017-1000034 · ADVISORY
akka/akka · WEB
akka/akka commit cc6561b · WEB
GitHub Advisory GHSA-mm57-9j6q-rxm2 · ADVISORY
doc.akka.io/docs/akka/2.4/security/2017-02-10-java-serialization.html · WEB

Running one of these products? Scan your site to see whether it exposes a vulnerable version.

Scan my site free