GHSA-9qgc-p27w-3hjg
High severity vulnerability that affects com.typesafe.akka:akka-http-core_2.11 and com.typesafe.akka:akka-http-core_2.12
Packages
| Ecosystem | Package | Affected | Fixed in |
|---|---|---|---|
| Maven | com.typesafe.akka:akka-http-core_2.12 | >= 10.1.0, < 10.1.4 | 10.1.4 |
| Maven | com.typesafe.akka:akka-http-core_2.11 | >= 10.1.0, < 10.1.4 | 10.1.4 |
Details
As written in the advisory (Markdown source, shown as plain text).
The decodeRequest and decodeRequestWith directives in Lightbend Akka HTTP 10.1.x through 10.1.4 and 10.0.x through 10.0.13 allow remote attackers to cause a denial of service (memory consumption and daemon crash) via a ZIP bomb.
References
External links from the advisory. They lead to third-party sites.
- https://nvd.nist.gov/vuln/detail/CVE-2018-16131
- https://github.com/akka/akka-http/issues/2137
- https://akka.io/blog/news/2018/08/30/akka-http-dos-vulnerability-found
- https://doc.akka.io/docs/akka-http/current/security/2018-09-05-denial-of-service-via-decodeRequest.html
- https://github.com/advisories/GHSA-9qgc-p27w-3hjg
- https://groups.google.com/forum/#!topic/akka-security/Dj7INsYWdjg