GHSA-2w7w-2j92-44hx

HTTP Request Smuggling in akka-http-core

Source: GitHub Advisory Database (reviewed) Moderate CVE-2021-23339

Packages

Ecosystem	Package	Affected	Fixed in
Maven	com.typesafe.akka:akka-http-core	>= 10.2.0, < 10.2.4	10.2.4
Maven	com.typesafe.akka:akka-http-core	< 10.1.14	10.1.14

Details

As written in the advisory (Markdown source, shown as plain text).

A vulnerable Akka HTTP server will accept a malformed message and hand it over to the user. If the user application proxies this message to another server unchanged and that server also accepts that message but interprets it as two HTTP messages, the second message has reached the second server without having been inspected by the proxy.

References

External links from the advisory. They lead to third-party sites.

https://nvd.nist.gov/vuln/detail/CVE-2021-23339 advisory
https://github.com/akka/akka-http/pull/3754%23issuecomment-779265201 web
https://github.com/akka/akka-http/commit/e3a4935151c91cee28e65e6b894dd50839ef9d34 web
https://doc.akka.io/docs/akka-http/10.1/security/2021-02-24-incorrect-handling-of-Transfer-Encoding-header.html web
https://snyk.io/vuln/SNYK-JAVA-COMTYPESAFEAKKA-1075043 web