| Package | Affected versions | Patched versions |
|---|---|---|
| com.typesafe.akka:aakka-http-core_2.13.0-M3 | ≥ 10.1.0 | |
| com.typesafe.akka:akka-http-core_2.11 | ≥ 10.1.0, < 10.1.15 | 10.1.15 |
| com.typesafe.akka:akka-http-core_2.12 | ≥ 10.1.0, < 10.1.15≥ 10.2.0-M1, < 10.2.7 | 10.1.1510.2.7 |
| com.typesafe.akka:akka-http-core_2.13 | ≥ 10.1.0, < 10.1.15≥ 10.2.0-M1, < 10.2.7 | 10.1.1510.2.7 |
| com.typesafe.akka:akka-http-core_2.13.0-M5 | ≥ 10.1.0 | |
| com.typesafe.akka:akka-http-core_2.13.0-RC2 | ≥ 10.1.0 | |
| com.typesafe.akka:akka-http-core_2.13.0-RC3 | ≥ 10.1.0 | |
| http server | ≥ 10.1.0, < 10.1.15≥ 10.2.0, < 10.2.7 | 10.1.1510.2.7 |
Akka HTTP 10.1.x and 10.2.x before 10.2.7 can encounter stack exhaustion while parsing HTTP headers, which allows a remote attacker to conduct a Denial of Service attack by sending a User-Agent header with deeply nested comments.
Running one of these products? Scan your site to see whether it exposes a vulnerable version.
Scan my site free