CVE-2021-42697 in the critical feed json
Uncontrolled Recursion in Akka HTTP
published 2021-11-02 5 y ago modified 2026-06-17 4 mo ago also GHSA-3hw2-h67c-wq66 , EUVD-2022-2193
- cvss
- 7.5
- version 3.1, NVD
- cisa kev
- Not listed
- not in CISA's catalog
- epss
- 36.1%
- EPSS 36.1% chance of exploitation in 30 days, percentile 98%
- public exploits
- 1
- Exploit-DB
Summary
Akka HTTP 10.1.x before 10.1.15 and 10.2.x before 10.2.7 can encounter stack exhaustion while parsing HTTP headers, which allows a remote attacker to conduct a Denial of Service attack by sending a User-Agent header with deeply nested comments.
Patch / fix
- maven com.typesafe.akka:akka-http-core_2.13 10.1.15, 10.2.7
- maven com.typesafe.akka:akka-http-core_2.12 10.1.15, 10.2.7
- maven com.typesafe.akka:akka-http-core_2.11 10.1.15
- akka http_server 10.1.15, 10.2.7
- github.com/akka/akka-http#3924 pull request
Timeline
- Published
- First public exploit (EDB-50892)
Exploit prediction
36.14% chance of exploitation in the next 30 days, higher than 98% of all scored CVEs (FIRST EPSS, 2026-11-08).
Exploits and checks
- EDB-50892 Akka HTTP 10.1.14 - Denial of Service remote, 2022-05-11
- packetstormsecurity.com http://packetstormsecurity.com/files/167018/Akka-HTTP-10.1.14-Denial-Of-Service.html referenced PoC, tagged "exploit" by a source, unverified
CVSS scores
| assigned by | version | score | vector |
|---|---|---|---|
| NVD | 3.1 | 7.5 | CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H |
| NVD | 2.0 | 5.0 | AV:N/AC:L/Au:N/C:N/I:N/A:P |
| GitHub | 3.1 | 7.5 | CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H |
Affected packages
| ecosystem | package | affected | fixed in |
|---|---|---|---|
| maven | com.typesafe.akka:akka-http-core_2.13.0-RC3 | >=10.1.0 |
no fix listed |
| maven | com.typesafe.akka:akka-http-core_2.13.0-RC2 | >=10.1.0 |
no fix listed |
| maven | com.typesafe.akka:akka-http-core_2.13.0-M5 | >=10.1.0 |
no fix listed |
| maven | com.typesafe.akka:aakka-http-core_2.13.0-M3 | >=10.1.0 |
no fix listed |
| maven | com.typesafe.akka:akka-http-core_2.13 | >=10.1.0, <10.1.15 >=10.2.0-M1, <10.2.7 |
10.1.15 10.2.7 |
| maven | com.typesafe.akka:akka-http-core_2.12 | >=10.1.0, <10.1.15 >=10.2.0-M1, <10.2.7 |
10.1.15 10.2.7 |
| maven | com.typesafe.akka:akka-http-core_2.11 | >=10.1.0, <10.1.15 |
10.1.15 |
Classification
References
-
github.com
/akka/akka-http/pull/3924
web
-
packetstormsecurity.com
/files/167018/Akka-HTTP-10.1.14-Denial-Of-Service.html
web, exploit, third-party-advisory, vdb-entry
-
akka.io
/blog/
vendor-advisory
-
doc.akka.io
/docs/akka-http/current/security/2021-CVE-2021-42697-stack-overflow-parsing-user-agent.html
web, vendor-advisory
-
akka.io
/blog/news/2021/11/02/akka-http-10.2.7-released
web, release-notes, vendor-advisory
-
akka.io
/blog/news/2021/11/22/akka-http-10.1.15-released
web, release-notes, vendor-advisory
-
nvd.nist.gov
/vuln/detail/CVE-2021-42697
advisory
-
akka.io
/blog
web
-
github.com
/akka/akka-http
package
Sources
- CVE List CVE-2021-42697
- GitHub Advisory GHSA-3hw2-h67c-wq66
- NVD CVE-2021-42697
Fencer Vulns keeps one entry per vulnerability: the CVE id wins, then GHSA, and records that alias each other are merged, except that two CVEs always keep separate entries. The same data is available as JSON.