{"id":"CVE-2021-42697","published":"2021-11-02T21:44:54Z","modified":"2024-08-04T03:38:50Z","title":"Akka HTTP 10.1.x before 10.1.15 and 10.2.x before 10.2.7 can encounter stack exhaustion while parsing HTTP headers…","vendor":null,"product":null,"tier":"tail","description":{"text":"Akka HTTP 10.1.x before 10.1.15 and 10.2.x before 10.2.7 can encounter stack exhaustion while parsing HTTP headers, which allows a remote attacker to conduct a Denial of Service attack by sending a User-Agent header with deeply nested comments.","provenance":"source","from":"CVE.org"},"cvss":null,"epss":{"score":0.36139,"percentile":0.9847,"provenance":"source"},"cwes":[],"references":[{"url":"https://akka.io/blog/","tags":["x_refsource_MISC"]},{"url":"https://doc.akka.io/docs/akka-http/current/security/2021-CVE-2021-42697-stack-overflow-parsing-user-agent.html","tags":["x_refsource_MISC"]},{"url":"https://akka.io/blog/news/2021/11/02/akka-http-10.2.7-released","tags":["x_refsource_MISC"]},{"url":"https://akka.io/blog/news/2021/11/22/akka-http-10.1.15-released","tags":["x_refsource_MISC"]},{"url":"http://packetstormsecurity.com/files/167018/Akka-HTTP-10.1.14-Denial-Of-Service.html","tags":["x_refsource_MISC"]}],"priority":{"score":24.7,"factors":[{"name":"EPSS percentile","points":19.69},{"name":"Public exploit code","points":5.0}]},"exploitSources":{"exploitdb":{"count":1,"earliest":"2022-05-11"},"pocGithub":{"count":1,"skipped":0,"earliest":"2022-04-24","earliestUrl":"https://github.com/cxosmo/CVE-2021-42697","repos":[{"name":"cxosmo/CVE-2021-42697","url":"https://github.com/cxosmo/CVE-2021-42697","stars":1,"created":"2022-04-24"}]},"first":{"date":"2022-04-24","source":"PoC-in-GitHub","url":"https://github.com/cxosmo/CVE-2021-42697"},"provenance":"source"},"affected":[{"ecosystem":"Maven","package":"com.typesafe.akka:akka-http-core_2.13.0-RC3","vulnerableRanges":[">=10.1.0, <10.1.15"],"patched":[],"from":["GHSA-3hw2-h67c-wq66"],"provenance":"source"},{"ecosystem":"Maven","package":"com.typesafe.akka:akka-http-core_2.13.0-RC2","vulnerableRanges":[">=10.1.0, <10.1.15"],"patched":[],"from":["GHSA-3hw2-h67c-wq66"],"provenance":"source"},{"ecosystem":"Maven","package":"com.typesafe.akka:akka-http-core_2.13.0-M5","vulnerableRanges":[">=10.1.0, <10.1.15"],"patched":[],"from":["GHSA-3hw2-h67c-wq66"],"provenance":"source"},{"ecosystem":"Maven","package":"com.typesafe.akka:aakka-http-core_2.13.0-M3","vulnerableRanges":[">=10.1.0, <10.1.15"],"patched":[],"from":["GHSA-3hw2-h67c-wq66"],"provenance":"source"},{"ecosystem":"Maven","package":"com.typesafe.akka:akka-http-core_2.13","vulnerableRanges":[">=10.1.0, <10.1.15",">=10.2.0-M1, <10.2.7"],"patched":["10.1.15","10.2.7"],"from":["GHSA-3hw2-h67c-wq66"],"provenance":"source"},{"ecosystem":"Maven","package":"com.typesafe.akka:akka-http-core_2.12","vulnerableRanges":[">=10.1.0, <10.1.15",">=10.2.0-M1, <10.2.7"],"patched":["10.1.15","10.2.7"],"from":["GHSA-3hw2-h67c-wq66"],"provenance":"source"},{"ecosystem":"Maven","package":"com.typesafe.akka:akka-http-core_2.11","vulnerableRanges":[">=10.1.0, <10.1.15"],"patched":["10.1.15"],"from":["GHSA-3hw2-h67c-wq66"],"provenance":"source"}],"euvd":{"id":"EUVD-2022-2193","exploited":false,"provenance":"source"},"exploits":[{"id":50892,"url":"https://www.exploit-db.com/exploits/50892","title":"Akka HTTP 10.1.14 - Denial of Service","date":"2022-05-11","verified":false,"provenance":"source"}],"exploitRefs":["http://packetstormsecurity.com/files/167018/Akka-HTTP-10.1.14-Denial-Of-Service.html"],"lineage":{"packageHistory":[{"cve":"CVE-2017-1000118","published":"2017-10-04","fixed":"10.0.6","kev":false},{"cve":"CVE-2018-16131","published":"2018-08-30","fixed":"10.1.4","kev":false},{"cve":"CVE-2021-42697","published":"2021-11-02","fixed":"10.2.7","kev":false},{"cve":"CVE-2023-44487","published":"2023-10-10","fixed":"10.5.3","kev":true,"link":{"from":"CVE-2021-42697","to":"CVE-2023-44487","relation":"successor","confidence":"low","kind":"sequence","evidence":[{"kind":"version-step","provenance":"source","package":"Maven:com.typesafe.akka:akka-http-core_2.12","fromFixed":"10.2.7","toFixed":"10.5.3","daysApart":707},{"kind":"version-step","provenance":"source","package":"Maven:com.typesafe.akka:akka-http-core_2.13","fromFixed":"10.2.7","toFixed":"10.5.3","daysApart":707}]}}],"package":"Maven:com.typesafe.akka:akka-http-core_2.12"}}