High severity vulnerability that affects com.typesafe.akka:akka-http-core_2.11 and com.typesafe.akka:akka-http-core_2.12

概要

参考情報

• nvd.nist.gov/vuln/detail/CVE-2018-16131 · ADVISORY
• akka/akka-http · WEB
• akka.io/blog/news/2018/08/30/akka-http-dos-vulnerability-found · WEB
• doc.akka.io/docs/akka-http/current/security/2018-09-05-denial-of-service-via-decodeRequest.html · WEB
• GitHub Advisory GHSA-9qgc-p27w-3hjg · ADVISORY
• groups.google.com/forum · WEB
• groups.google.com/forum

com.typesafe.akka:akka-http-core_2.11 のその他の脆弱性

• CVE-2023-44487高 7.5悪用確認済み（CISA KEV）The HTTP/2 protocol allows a denial of service (server resource consumption) because request cancellation can reset many streams quickly, as…
• CVE-2021-42697高 7.5Akka HTTP 10.1.x before 10.1.15 and 10.2.x before 10.2.7 can encounter stack exhaustion while parsing HTTP headers, which allows a remote at…
• CVE-2017-1000118高 7.5Akka HTTP versions <= 10.0.5 Illegal Media Range in Accept Header Causes StackOverflowError Leading to Denial of Service