CVE-2021-42697

Akka HTTP 10.1.x before 10.1.15 and 10.2.x before 10.2.7 can encounter stack exhaustion while parsing HTTP headers, which allows a remote attacker to conduct a Denial of Service attack by sending a User-Agent header with deeply nested comments. References MITRE Akka blog Arbitrary nesting of...

EUVD-2021-0909

Malware in sbrugna...

EUVD-2018-0601

Malware in sbrugna...

EUVD-2018-0565

Malware in sbrugna...

EUVD-2023-37419

Malicious code in bioql PyPI...

EUVD-2022-0445

Malicious code in bioql PyPI...

EUVD-2022-1143

Malicious code in bioql PyPI...

CVE-2023-33251

When Akka HTTP before 10.5.2 accepts file uploads via the FileUploadDirectives.fileUploadAll directive, the temporary file it creates has too weak permissions: it is readable by other users on Linux or UNIX, a similar issue to CVE-2022-41946...

CVE-2021-42697

Akka HTTP 10.1.x before 10.1.15 and 10.2.x before 10.2.7 can encounter stack exhaustion while parsing HTTP headers, which allows a remote attacker to conduct a Denial of Service attack by sending a User-Agent header with deeply nested comments...

CVE-2017-1000118

Akka HTTP versions = 10.0.5 Illegal Media Range in Accept Header Causes StackOverflowError Leading to Denial of Service...

HTTP Request/Response Smuggling

com.typesafe.akka:akka-http-core is vulnerable to HTTP Request/Response Smuggling. The vulnerability is due to accepting malformed messages and handing them over to the user application, which may proxy them to another server without inspection, allowing unintended HTTP requests to reach downstre...

com.fullfacing:keycloak4s-auth-akka-http_2.12 (2.1.0), com.fullfacing:keycloak4s-auth-akka-http_2.13 (2.1.0) +11 more potentially affected by CVE-2023-52428 via com.nimbusds:nimbus-jose-jwt (8.11)

com.nimbusds:nimbus-jose-jwt MAVEN version 8.11 is affected by a known vulnerability. The following packages have a transitive dependency on com.nimbusds:nimbus-jose-jwt and may be impacted: - com.fullfacing:keycloak4s-auth-akka-http2.12 2.1.0 - com.fullfacing:keycloak4s-auth-akka-http2.13 2.1.0 ...

com.typesafe.akka:akka-http-experimental_2.11 (2.4-artery-m4), com.typesafe.akka:akka-http-jackson-experimental_2.11 (2.4-artery-m4) +3 more potentially affected by CVE-2023-44487 via com.typesafe.akka:akka-http-core_2.11 (2.4-artery-m4)

com.typesafe.akka:akka-http-core2.11 MAVEN version 2.4-artery-m4 is affected by a known vulnerability. The following packages have a transitive dependency on com.typesafe.akka:akka-http-core2.11 and may be impacted: - com.typesafe.akka:akka-http-experimental2.11 2.4-artery-m4 -...

ch.megard:akka-http-cors_2.11 (0.1.6), com.arpnetworking.metrics:metrics-portal_2.11 (>=0.5.4, <=0.7.1) +45 more potentially affected by CVE-2023-44487 via com.typesafe.akka:akka-http-core_2.11 (2.4.10)

com.typesafe.akka:akka-http-core2.11 MAVEN version 2.4.10 is affected by a known vulnerability. The following packages have a transitive dependency on com.typesafe.akka:akka-http-core2.11 and may be impacted: - ch.megard:akka-http-cors2.11 0.1.6 - com.arpnetworking.metrics:metrics-portal2.11...

com.typesafe.akka:akka-http (3.0.0-rc1), com.typesafe.akka:akka-http-jackson (3.0.0-rc1) +3 more potentially affected by CVE-2023-44487 via com.typesafe.akka:akka-http-core (3.0.0-rc1)

com.typesafe.akka:akka-http-core MAVEN version 3.0.0-rc1 is affected by a known vulnerability. The following packages have a transitive dependency on com.typesafe.akka:akka-http-core and may be impacted: - com.typesafe.akka:akka-http 3.0.0-rc1 - com.typesafe.akka:akka-http-jackson 3.0.0-rc1 -...

com.github.benniekrijger:scala-postnl_2.11 (0.6), com.typesafe.akka:akka-http-experimental_2.11 (2.4.9-rc2) +9 more potentially affected by CVE-2023-44487 via com.typesafe.akka:akka-http-core_2.11 (2.4.9-rc2)

com.typesafe.akka:akka-http-core2.11 MAVEN version 2.4.9-rc2 is affected by a known vulnerability. The following packages have a transitive dependency on com.typesafe.akka:akka-http-core2.11 and may be impacted: - com.github.benniekrijger:scala-postnl2.11 0.6 -...

ai.mantik:bridge-protocol_2.13 (>=0.4.0-rc1, <=0.4.0), ai.mantik:componently_2.13 (>=0.4.0-rc1, <=0.4.0) +1041 more potentially affected by CVE-2023-44487 via com.typesafe.akka:akka-http-core_2.13 (>=10.1.8, <=10.5.2)

com.typesafe.akka:akka-http-core2.13 MAVEN version =10.1.8, =0.4.0-rc1, =0.4.0-rc1, =0.4.0-rc1, =0.4.0-rc1, =0.4.0-rc1, =0.4.0-rc1, =0.4.0-rc1, =0.4.0-rc1, =0.4.0-rc1, =0.4.0-rc1, =0.4.0-rc1, =0.4.0-rc1, =0.4.0-rc1, =0.4.0-rc1, =0.4.0-rc1, =0.4.0 and more Source cves: CVE-2023-44487 Source...

co.pragmati:swagger-ui-akka-http_2.11 (1.0.0), com.typesafe.akka:akka-http-experimental_2.11 (2.4.11.2) +11 more potentially affected by CVE-2023-44487 via com.typesafe.akka:akka-http-core_2.11 (2.4.11.2)

com.typesafe.akka:akka-http-core2.11 MAVEN version 2.4.11.2 is affected by a known vulnerability. The following packages have a transitive dependency on com.typesafe.akka:akka-http-core2.11 and may be impacted: - co.pragmati:swagger-ui-akka-http2.11 1.0.0 -...

ch.megard:akka-http-cors_2.11 (0.1.1), com.github.agourlay:cornichon_2.11 (>=0.7.0, <=0.7.1) +25 more potentially affected by CVE-2023-44487 via com.typesafe.akka:akka-http-core_2.11 (2.4.3)

com.typesafe.akka:akka-http-core2.11 MAVEN version 2.4.3 is affected by a known vulnerability. The following packages have a transitive dependency on com.typesafe.akka:akka-http-core2.11 and may be impacted: - ch.megard:akka-http-cors2.11 0.1.1 - com.github.agourlay:cornichon2.11 =0.7.0, =0.0.1,...

com.github.agourlay:cornichon_2.11 (0.6.0), com.typesafe.akka:akka-http-experimental_2.11 (2.4.2-rc2) +12 more potentially affected by CVE-2023-44487 via com.typesafe.akka:akka-http-core_2.11 (2.4.2-rc2)

com.typesafe.akka:akka-http-core2.11 MAVEN version 2.4.2-rc2 is affected by a known vulnerability. The following packages have a transitive dependency on com.typesafe.akka:akka-http-core2.11 and may be impacted: - com.github.agourlay:cornichon2.11 0.6.0 -...