com.datto:flow_2.11 (>=0.0.1, <=1.4.0), com.github.agourlay:cornichon_2.11 (0.7.4) +16 more potentially affected by CVE-2017-1000118 via com.typesafe.akka:akka-http-core_2.11 (2.4.6)

com.typesafe.akka:akka-http-core2.11 MAVEN version 2.4.6 is affected by a known vulnerability. The following packages have a transitive dependency on com.typesafe.akka:akka-http-core2.11 and may be impacted: - com.datto:flow2.11 =0.0.1, =0.2.0, =2.0.3, =1.0.7, =1.0.9 -...

com.typesafe.akka:akka-http-experimental_2.11 (2.4-artery-m3), com.typesafe.akka:akka-http-jackson-experimental_2.11 (2.4-artery-m3) +3 more potentially affected by CVE-2017-1000118 via com.typesafe.akka:akka-http-core_2.11 (2.4-artery-m3)

com.typesafe.akka:akka-http-core2.11 MAVEN version 2.4-artery-m3 is affected by a known vulnerability. The following packages have a transitive dependency on com.typesafe.akka:akka-http-core2.11 and may be impacted: - com.typesafe.akka:akka-http-experimental2.11 2.4-artery-m3 -...

com.typesafe.akka:akka-http-experimental_2.11 (2.4.2-rc1), com.typesafe.akka:akka-http-jackson-experimental_2.11 (2.4.2-rc1) +19 more potentially affected by CVE-2017-1000118 via com.typesafe.akka:akka-http-core_2.11 (2.4.2-rc1)

com.typesafe.akka:akka-http-core2.11 MAVEN version 2.4.2-rc1 is affected by a known vulnerability. The following packages have a transitive dependency on com.typesafe.akka:akka-http-core2.11 and may be impacted: - com.typesafe.akka:akka-http-experimental2.11 2.4.2-rc1 -...

com.github.agourlay:cornichon_2.11 (0.6.0), com.typesafe.akka:akka-http-experimental_2.11 (2.4.2-rc2) +12 more potentially affected by CVE-2017-1000118 via com.typesafe.akka:akka-http-core_2.11 (2.4.2-rc2)

com.typesafe.akka:akka-http-core2.11 MAVEN version 2.4.2-rc2 is affected by a known vulnerability. The following packages have a transitive dependency on com.typesafe.akka:akka-http-core2.11 and may be impacted: - com.github.agourlay:cornichon2.11 0.6.0 -...

com.typesafe.akka:akka-http-experimental_2.11 (2.4-artery-m1), com.typesafe.akka:akka-http-jackson-experimental_2.11 (2.4-artery-m1) +3 more potentially affected by CVE-2017-1000118 via com.typesafe.akka:akka-http-core_2.11 (2.4-artery-m1)

com.typesafe.akka:akka-http-core2.11 MAVEN version 2.4-artery-m1 is affected by a known vulnerability. The following packages have a transitive dependency on com.typesafe.akka:akka-http-core2.11 and may be impacted: - com.typesafe.akka:akka-http-experimental2.11 2.4-artery-m1 -...

com.github.karasiq:nanoboard_2.11 (1.3.0), com.typesafe.akka:akka-http-experimental_2.11 (2.4.5) +7 more potentially affected by CVE-2017-1000118 via com.typesafe.akka:akka-http-core_2.11 (2.4.5)

com.typesafe.akka:akka-http-core2.11 MAVEN version 2.4.5 is affected by a known vulnerability. The following packages have a transitive dependency on com.typesafe.akka:akka-http-core2.11 and may be impacted: - com.github.karasiq:nanoboard2.11 1.3.0 - com.typesafe.akka:akka-http-experimental2.11...

ch.megard:akka-http-cors_2.11 (0.1.6), com.arpnetworking.metrics:metrics-portal_2.11 (>=0.5.4, <=0.7.1) +45 more potentially affected by CVE-2017-1000118 via com.typesafe.akka:akka-http-core_2.11 (2.4.10)

com.typesafe.akka:akka-http-core2.11 MAVEN version 2.4.10 is affected by a known vulnerability. The following packages have a transitive dependency on com.typesafe.akka:akka-http-core2.11 and may be impacted: - ch.megard:akka-http-cors2.11 0.1.6 - com.arpnetworking.metrics:metrics-portal2.11...

com.arpnetworking.metrics:metrics-aggregator-daemon (>=1.4.1, <=1.7.0), com.typesafe.akka:akka-http-experimental_2.11 (2.4.11.1) +6 more potentially affected by CVE-2017-1000118 via com.typesafe.akka:akka-http-core_2.11 (2.4.11.1)

com.typesafe.akka:akka-http-core2.11 MAVEN version 2.4.11.1 is affected by a known vulnerability. The following packages have a transitive dependency on com.typesafe.akka:akka-http-core2.11 and may be impacted: - com.arpnetworking.metrics:metrics-aggregator-daemon =1.4.1, =1.7.0 -...

ch.megard:akka-http-cors_2.11 (0.1.0), com.arpnetworking.metrics:metrics-aggregator-daemon (>=1.0.0, <=1.4.0) +42 more potentially affected by CVE-2017-1000118 via com.typesafe.akka:akka-http-core_2.11 (2.4.2)

com.typesafe.akka:akka-http-core2.11 MAVEN version 2.4.2 is affected by a known vulnerability. The following packages have a transitive dependency on com.typesafe.akka:akka-http-core2.11 and may be impacted: - ch.megard:akka-http-cors2.11 0.1.0 - com.arpnetworking.metrics:metrics-aggregator-daemo...

ca.schwitzer:scaladon_2.11 (>=0.3.1, <=0.4.0-m0), ch.becompany:akka-social-stream_2.11 (>=0.1.0, <=0.1.1) +185 more potentially affected by CVE-2017-1000118 via com.typesafe.akka:akka-http-core_2.11 (>=10.0.0-rc2, <=10.0.5)

com.typesafe.akka:akka-http-core2.11 MAVEN version =10.0.0-rc2, =0.3.1, =0.1.0, =0.1.9, =1.2.2, =0.1.4, =4.0, =0.2.0, =3.0.7, =3.0.5, =v0.0.9, =v0.0.9, =0.11.1, =0.10.2, =0.10, =0.15 and more Source cves: CVE-2017-1000118 Source advisory: GHSA-GFX6-PH4Q-Q54Q...

Improper Restriction of Operations within the Bounds of a Memory Buffer in akka-http-core

Akka HTTP versions = 10.0.5 Illegal Media Range in Accept Header Causes StackOverflowError Leading to Denial of Service...

ca.schwitzer:scaladon_2.12 (>=0.3.0, <=0.4.0-m0), ch.megard:akka-http-cors_2.12 (>=0.1.9, <=0.2.1) +120 more potentially affected by CVE-2017-1000118 via com.typesafe.akka:akka-http-core_2.12 (>=10.0.0-rc2, <=10.0.5)

com.typesafe.akka:akka-http-core2.12 MAVEN version =10.0.0-rc2, =0.3.0, =0.1.9, =0.1.4, =4.0, =0.2.0, =3.0.7, =3.0.6, =0.11.1, =0.10.2, =0.13.0, =0.10, =0.10, =0.2.0, =0.2.1 - com.github.hayasshi:akkahttpeasyrouter2.12 0.0.1 and more Source cves: CVE-2017-1000118 Source advisory: GHSA-GFX6-PH4Q-Q...

ai.agnos:reactive-sparql_2.12 (>=0.3.0, <=0.3.1), ch.megard:akka-http-cors_2.12 (>=0.3.0, <=0.3.1) +284 more potentially affected by CVE-2018-16131 via com.typesafe.akka:akka-http-core_2.12 (>=10.1.0, <=10.1.3)

com.typesafe.akka:akka-http-core2.12 MAVEN version =10.1.0, =0.3.0, =0.3.0, =0.3.0-rc7, =0.3.0-rc7, =0.3.0-rc7, =0.3.0-rc7, =3.0.0, =0.4.1, =0.4.1, =0.4.1, =0.5.0, =0.4.13, =0.6, =0.6, =0.7 and more Source cves: CVE-2018-16131 Source advisory: OSV:GHSA-9QGC-P27W-3HJG...

ch.megard:akka-http-cors_2.11 (>=0.3.0, <=0.3.1), com.arpnetworking.metrics:metrics-aggregator-daemon (>=1.10.0, <=1.11.1) +166 more potentially affected by CVE-2018-16131 via com.typesafe.akka:akka-http-core_2.11 (>=10.1.0, <=10.1.3)

com.typesafe.akka:akka-http-core2.11 MAVEN version =10.1.0, =0.3.0, =1.10.0, =3.0.0, =0.5.4, =0.5.4, =0.5.4, =0.4.13, =5.0.2, =5.0.2, =0.2.21, =0.2.21, =0.16.0, =0.16.0, =0.16.0, =0.16.1 and more Source cves: CVE-2018-16131 Source advisory: GHSA-9QGC-P27W-3HJG...

ai.agnos:reactive-sparql_2.12 (>=0.3.0, <=0.3.1), ch.megard:akka-http-cors_2.12 (>=0.3.0, <=0.3.1) +284 more potentially affected by CVE-2018-16131 via com.typesafe.akka:akka-http-core_2.12 (>=10.1.0, <=10.1.3)

com.typesafe.akka:akka-http-core2.12 MAVEN version =10.1.0, =0.3.0, =0.3.0, =0.3.0-rc7, =0.3.0-rc7, =0.3.0-rc7, =0.3.0-rc7, =3.0.0, =0.4.1, =0.4.1, =0.4.1, =0.5.0, =0.4.13, =0.6, =0.6, =0.7 and more Source cves: CVE-2018-16131 Source advisory: GHSA-9QGC-P27W-3HJG...

GHSA-9QGC-P27W-3HJG High severity vulnerability that affects com.typesafe.akka:akka-http-core_2.11 and com.typesafe.akka:akka-http-core_2.12

The decodeRequest and decodeRequestWith directives in Lightbend Akka HTTP 10.1.x through 10.1.4 and 10.0.x through 10.0.13 allow remote attackers to cause a denial of service memory consumption and daemon crash via a ZIP bomb...

ch.megard:akka-http-cors_2.11 (>=0.3.0, <=0.3.1), com.arpnetworking.metrics:metrics-aggregator-daemon (>=1.10.0, <=1.11.1) +166 more potentially affected by CVE-2018-16131 via com.typesafe.akka:akka-http-core_2.11 (>=10.1.0, <=10.1.3)

com.typesafe.akka:akka-http-core2.11 MAVEN version =10.1.0, =0.3.0, =1.10.0, =3.0.0, =0.5.4, =0.5.4, =0.5.4, =0.4.13, =5.0.2, =5.0.2, =0.2.21, =0.2.21, =0.16.0, =0.16.0, =0.16.0, =0.16.1 and more Source cves: CVE-2018-16131 Source advisory: OSV:GHSA-9QGC-P27W-3HJG...

High severity vulnerability that affects com.typesafe.akka:akka-http-core_2.11 and com.typesafe.akka:akka-http-core_2.12

The decodeRequest and decodeRequestWith directives in Lightbend Akka HTTP 10.1.x through 10.1.4 and 10.0.x through 10.0.13 allow remote attackers to cause a denial of service memory consumption and daemon crash via a ZIP bomb...

Directory Traversal

akka-http is vulnerable to directory traversal attacks. The vulnerability exists due to the lack of sanitization of the resource path, allowing directory traversal in windows deployments...

Denial Of Service (DoS) Via Zip Bomb

akka-http is vulnerable to denial of service via a Zip Bomb. The vulnerability is caused by the application not having size limitations on decompressed data from the directives decodeRequest and decodeRequestWith or when using them in combination with directives like entityas, toStrict, or...