EUVD-2021-0909

Malware in sbrugna...

HTTP Request/Response Smuggling

com.typesafe.akka:akka-http-core is vulnerable to HTTP Request/Response Smuggling. The vulnerability is due to accepting malformed messages and handing them over to the user application, which may proxy them to another server without inspection, allowing unintended HTTP requests to reach downstre...

com.typesafe.akka:akka-http-experimental_2.11 (2.4-artery-m4), com.typesafe.akka:akka-http-jackson-experimental_2.11 (2.4-artery-m4) +3 more potentially affected by CVE-2023-44487 via com.typesafe.akka:akka-http-core_2.11 (2.4-artery-m4)

com.typesafe.akka:akka-http-core2.11 MAVEN version 2.4-artery-m4 is affected by a known vulnerability. The following packages have a transitive dependency on com.typesafe.akka:akka-http-core2.11 and may be impacted: - com.typesafe.akka:akka-http-experimental2.11 2.4-artery-m4 -...

com.typesafe.akka:akka-http (3.0.0-rc1), com.typesafe.akka:akka-http-jackson (3.0.0-rc1) +3 more potentially affected by CVE-2023-44487 via com.typesafe.akka:akka-http-core (3.0.0-rc1)

com.typesafe.akka:akka-http-core MAVEN version 3.0.0-rc1 is affected by a known vulnerability. The following packages have a transitive dependency on com.typesafe.akka:akka-http-core and may be impacted: - com.typesafe.akka:akka-http 3.0.0-rc1 - com.typesafe.akka:akka-http-jackson 3.0.0-rc1 -...

com.typesafe.akka:akka-http-experimental_2.11 (2.4-artery-m3), com.typesafe.akka:akka-http-jackson-experimental_2.11 (2.4-artery-m3) +3 more potentially affected by CVE-2023-44487 via com.typesafe.akka:akka-http-core_2.11 (2.4-artery-m3)

com.typesafe.akka:akka-http-core2.11 MAVEN version 2.4-artery-m3 is affected by a known vulnerability. The following packages have a transitive dependency on com.typesafe.akka:akka-http-core2.11 and may be impacted: - com.typesafe.akka:akka-http-experimental2.11 2.4-artery-m3 -...

com.github.agourlay:cornichon_2.11 (>=0.10, <=0.10.1), com.github.benniekrijger:scala-mollie_2.11 (>=0.8, <=0.9) +7 more potentially affected by CVE-2023-44487 via com.typesafe.akka:akka-http-core_2.11 (3.0.0-rc1)

com.typesafe.akka:akka-http-core2.11 MAVEN version 3.0.0-rc1 is affected by a known vulnerability. The following packages have a transitive dependency on com.typesafe.akka:akka-http-core2.11 and may be impacted: - com.github.agourlay:cornichon2.11 =0.10, =0.8, =0.2.7, =0.2.8 -...

com.github.benniekrijger:scala-postnl_2.11 (0.6), com.typesafe.akka:akka-http-experimental_2.11 (2.4.9-rc2) +9 more potentially affected by CVE-2023-44487 via com.typesafe.akka:akka-http-core_2.11 (2.4.9-rc2)

com.typesafe.akka:akka-http-core2.11 MAVEN version 2.4.9-rc2 is affected by a known vulnerability. The following packages have a transitive dependency on com.typesafe.akka:akka-http-core2.11 and may be impacted: - com.github.benniekrijger:scala-postnl2.11 0.6 -...

com.typesafe.akka:akka-http-experimental_2.11 (2.4.2-rc3), com.typesafe.akka:akka-http-jackson-experimental_2.11 (2.4.2-rc3) +9 more potentially affected by CVE-2023-44487 via com.typesafe.akka:akka-http-core_2.11 (2.4.2-rc3)

com.typesafe.akka:akka-http-core2.11 MAVEN version 2.4.2-rc3 is affected by a known vulnerability. The following packages have a transitive dependency on com.typesafe.akka:akka-http-core2.11 and may be impacted: - com.typesafe.akka:akka-http-experimental2.11 2.4.2-rc3 -...

com.typesafe.akka:akka-http-experimental_2.11 (2.4-artery-m1), com.typesafe.akka:akka-http-jackson-experimental_2.11 (2.4-artery-m1) +3 more potentially affected by CVE-2023-44487 via com.typesafe.akka:akka-http-core_2.11 (2.4-artery-m1)

com.typesafe.akka:akka-http-core2.11 MAVEN version 2.4-artery-m1 is affected by a known vulnerability. The following packages have a transitive dependency on com.typesafe.akka:akka-http-core2.11 and may be impacted: - com.typesafe.akka:akka-http-experimental2.11 2.4-artery-m1 -...

com.typesafe.akka:akka-http-experimental_2.11 (2.4-artery-m2), com.typesafe.akka:akka-http-jackson-experimental_2.11 (2.4-artery-m2) +3 more potentially affected by CVE-2023-44487 via com.typesafe.akka:akka-http-core_2.11 (2.4-artery-m2)

com.typesafe.akka:akka-http-core2.11 MAVEN version 2.4-artery-m2 is affected by a known vulnerability. The following packages have a transitive dependency on com.typesafe.akka:akka-http-core2.11 and may be impacted: - com.typesafe.akka:akka-http-experimental2.11 2.4-artery-m2 -...

Denial Of Service (DoS)

akka-http-core is vulnerable to Denial of Service DoS. A remote attacker is able to crash the application via a specifically crafted user-Agent header with deeply nested comments directed through vulnerable parser component...

Security Bulletin: akka-http-core Vulnerability Affects IBM Watson Machine Learning on CP4D (CVE-2021-23339)

Summary akka-http-core allows is vulnerable to allow multiple Transfer-Encoding headers on IBM Watson Machine Learning on CP4D Vulnerability Details CVEID: CVE-2021-23339 DESCRIPTION: com.typesafe.akka:akka-http-core is vulnerable to request smuggling, caused by improper validation of request. By...

CVE-2021-23339

This affects all versions before 10.1.14 and from 10.2.0 to 10.2.4 of package com.typesafe.akka:akka-http-core. It allows multiple Transfer-Encoding headers...

Design/Logic Flaw

This affects all versions before 10.1.14 and from 10.2.0 to 10.2.4 of package com.typesafe.akka:akka-http-core. It allows multiple Transfer-Encoding headers...

CVE-2021-23339

This affects all versions before 10.1.14 and from 10.2.0 to 10.2.4 of package com.typesafe.akka:akka-http-core. It allows multiple Transfer-Encoding headers...

CVE-2021-23339

CVE-2021-23339 affects com.typesafe.akka:akka-http-core. The flaw allows multiple Transfer-Encoding headers, enabling HTTP Request Smuggling due to improper validation of requests. Affected versions are all before 10.1.14 and 10.2.0–10.2.4. The issue is rooted in how Transfer-Encoding is handled,...

Lightbeed Akka Akka-http Environment Issue Vulnerability

Lightbeed Akka Akka-http is a toolkit from the Lightbeed community in China. It provides a more generalized toolkit for providing and using HTTP-based services. An environment issue vulnerability exists in com.typesafe.akka:akka-http-core that allows multiple Transfer-Encoding headers...

PT-2021-15443

Name of the Vulnerable Software and Affected Versions com.typesafe.akka:akka-http-core versions prior to 10.1.14 com.typesafe.akka:akka-http-core versions 10.2.0 through 10.2.4 Description The issue allows multiple Transfer-Encoding headers, which can lead to a malformed message being accepted by...

CVE-2021-23339: Inconsistent Interpretation of HTTP Requests

This affects all versions before 10.1.14 and from 10.2.0 to 10.2.4 of package com.typesafe.akka:akka-http-core. It allows multiple Transfer-Encoding headers...

HTTP Request Smuggling

Overview com.typesafe.akka:akka-http-core is a full server- and client-side HTTP stack on top of akka-actor and akka-stream. Affected versions of this package are vulnerable to HTTP Request Smuggling. It allows multiple Transfer-Encoding headers. Remediation Upgrade com.typesafe.akka:akka-http-co...