Design/Logic Flaw

When Akka HTTP before 10.5.2 accepts file uploads via the FileUploadDirectives.fileUploadAll directive, the temporary file it creates has too weak permissions: it is readable by other users on Linux or UNIX, a similar issue to CVE-2022-41946...

CVE-2023-33251

CVE-2023-33251 affects Akka HTTP prior to 10.5.2 where FileUploadDirectives.fileUploadAll creates a temporary file with overly permissive permissions, allowing other users on Unix-like systems to read it. This is an information disclosure risk tied to temporary-file handling in the file upload pa...

CVE-2023-33251

When Akka HTTP before 10.5.2 accepts file uploads via the FileUploadDirectives.fileUploadAll directive, the temporary file it creates has too weak permissions: it is readable by other users on Linux or UNIX, a similar issue to CVE-2022-41946...

Lightbeed Akka Akka-http security vulnerabilities

Lightbeed Akka Akka-http is a toolkit from the Lightbeed community in China. It provides a more generalized toolkit for providing and using HTTP-based services. A security vulnerability exists in Lightbeed Akka Akka-http versions prior to 10.5.2, which stems from weak permissions on temporary fil...

CVE-2023-33251

When Akka HTTP before 10.5.2 accepts file uploads via the FileUploadDirectives.fileUploadAll directive, the temporary file it creates has too weak permissions: it is readable by other users on Linux or UNIX, a similar issue to CVE-2022-41946...

CVE-2023-33251: Incorrect Permission Assignment for Critical Resource

When Akka HTTP before 10.5.2 accepts file uploads via the FileUploadDirectives.fileUploadAll directive, the temporary file it creates has too weak permissions: it is readable by other users on Linux or UNIX, a similar issue to CVE-2022-41946...

CVE-2023-33251

When Akka HTTP before 10.5.2 accepts file uploads via the FileUploadDirectives.fileUploadAll directive, the temporary file it creates has too weak permissions: it is readable by other users on Linux or UNIX, a similar issue to CVE-2022-41946...

ch.megard:akka-http-cors_3 (1.3.1), com.lightbend.akka.discovery:akka-discovery-aws-api-async_3 (>=1.3.0, <=1.4.1) +36 more potentially affected by CVE-2023-33251 via com.typesafe.akka:akka-http_3 (>=10.5.0-m1, <=10.5.1)

com.typesafe.akka:akka-http3 MAVEN version =10.5.0-m1, =1.3.0, =1.3.0, =1.3.0, =2.3.0-m1, =2.3.0-m1, =1.3.0, =1.3.0, =1.3.0, =1.3.0, =1.3.0, =1.3.0, =1.3.0, =1.4.0-m3, =1.1.0-m6, =1.5.0-m4 and more Source cves: CVE-2023-33251 Source advisory: MEND:CVE-2023-33251https:/...

Lightbeed Akka Akka-http security vulnerabilities

Lightbeed Akka Akka-http is a toolkit from the Lightbeed community in China. It provides a more generalized toolkit for providing and using HTTP-based services. A security vulnerability exists in Lightbeed Akka Akka-http versions prior to 2.8.1. An attacker exploited the vulnerability to cause an...

ai.starlake:starlake-spark2_2.11 (0.2.7), be.objectify:deadbolt-java_2.11 (>=2.7.0, <=2.7.1) +396 more potentially affected by CVE-2021-42697 via com.typesafe.akka:akka-http-core_2.11 (>=10.1.0, <=10.1.14)

com.typesafe.akka:akka-http-core2.11 MAVEN version =10.1.0, =2.7.0, =0.3.0, =1.10.0, =4.0.0-rc1, =1.0.0, =1.0.1-bump.0ef8b9fakka25circe08, =5.57.0akka25circe08, =0.11.2, =0.11.2+akka24circe011, =0.1.2akka25circe08, =0.1.3akka25circe08, =0.9.0, =3.0.0, =3.0.2 and more Source cves: CVE-2021-42697...

GHSA-3HW2-H67C-WQ66 Uncontrolled Recursion in Akka HTTP

Akka HTTP 10.1.x and 10.2.x before 10.2.7 can encounter stack exhaustion while parsing HTTP headers, which allows a remote attacker to conduct a Denial of Service attack by sending a User-Agent header with deeply nested comments...

ba.sake:hepek-play_2.13 (>=0.5.0, <=0.9.0), be.objectify:deadbolt-java_2.13 (>=2.7.1, <=2.8.0) +536 more potentially affected by CVE-2021-42697 via com.typesafe.akka:akka-http-core_2.13 (>=10.1.8, <=10.1.14)

com.typesafe.akka:akka-http-core2.13 MAVEN version =10.1.8, =0.5.0, =2.7.1, =2.7.1, =0.1.2, =0.1.2, =0.2.0, =0.1.2, =0.1.2, =0.1.2, =0.1.2, =0.2.0, =0.1.2, =0.1.2, =0.4.0, =0.4.0, =0.5.1 and more Source cves: CVE-2021-42697 Source advisory: OSV:GHSA-3HW2-H67C-WQ66...

ai.agnos:reactive-sparql_2.12 (>=0.3.0, <=0.3.1), ai.lum:odinson-rest-api_2.12 (>=0.2.0, <=0.5.0) +781 more potentially affected by CVE-2021-42697 via com.typesafe.akka:akka-http-core_2.12 (>=10.1.0, <=10.1.14)

com.typesafe.akka:akka-http-core2.12 MAVEN version =10.1.0, =0.3.0, =0.2.0, =0.3.0-rc3, =0.3.0-rc3, =0.3.0-rc3, =0.3.0-rc3, =0.3.0-rc3, =0.3.0-rc3, =0.3.0-rc3, =0.3.0-rc3, =0.3.0-rc3, =0.3.0-rc3, =0.3.0-rc3, =0.3.0-rc3, =0.3.0-rc3, =0.3.1-rc2 and more Source cves: CVE-2021-42697 Source advisory:...

ai.mantik:bridge-protocol_2.13 (>=0.4.0-rc1, <=0.4.0), ai.mantik:componently_2.13 (>=0.4.0-rc1, <=0.4.0) +428 more potentially affected by CVE-2021-42697 via com.typesafe.akka:akka-http-core_2.13 (>=10.2.0-m1, <=10.2.6)

com.typesafe.akka:akka-http-core2.13 MAVEN version =10.2.0-m1, =0.4.0-rc1, =0.4.0-rc1, =0.4.0-rc1, =0.4.0-rc1, =0.4.0-rc1, =0.4.0-rc1, =0.4.0-rc1, =0.4.0-rc1, =0.4.0-rc1, =0.4.0-rc1, =0.4.0-rc1, =0.4.0-rc1, =0.4.0-rc1, =0.4.0-rc1, =0.4.0-rc1, =0.4.0 and more Source cves: CVE-2021-42697 Source...

ai.starlake:starlake-spark2_2.11 (0.2.7), be.objectify:deadbolt-java_2.11 (>=2.7.0, <=2.7.1) +396 more potentially affected by CVE-2021-42697 via com.typesafe.akka:akka-http-core_2.11 (>=10.1.0, <=10.1.14)

com.typesafe.akka:akka-http-core2.11 MAVEN version =10.1.0, =2.7.0, =0.3.0, =1.10.0, =4.0.0-rc1, =1.0.0, =1.0.1-bump.0ef8b9fakka25circe08, =5.57.0akka25circe08, =0.11.2, =0.11.2+akka24circe011, =0.1.2akka25circe08, =0.1.3akka25circe08, =0.9.0, =3.0.0, =3.0.2 and more Source cves: CVE-2021-42697...

Uncontrolled Recursion in Akka HTTP

Akka HTTP 10.1.x and 10.2.x before 10.2.7 can encounter stack exhaustion while parsing HTTP headers, which allows a remote attacker to conduct a Denial of Service attack by sending a User-Agent header with deeply nested comments...

ai.mantik:bridge-protocol_2.13 (>=0.4.0-rc1, <=0.4.0), ai.mantik:componently_2.13 (>=0.4.0-rc1, <=0.4.0) +428 more potentially affected by CVE-2021-42697 via com.typesafe.akka:akka-http-core_2.13 (>=10.2.0-m1, <=10.2.6)

com.typesafe.akka:akka-http-core2.13 MAVEN version =10.2.0-m1, =0.4.0-rc1, =0.4.0-rc1, =0.4.0-rc1, =0.4.0-rc1, =0.4.0-rc1, =0.4.0-rc1, =0.4.0-rc1, =0.4.0-rc1, =0.4.0-rc1, =0.4.0-rc1, =0.4.0-rc1, =0.4.0-rc1, =0.4.0-rc1, =0.4.0-rc1, =0.4.0-rc1, =0.4.0 and more Source cves: CVE-2021-42697 Source...

ch.megard:akka-http-cors_2.12 (>=1.1.0, <=1.1.2), co.topl:akka-http-rpc_2.12 (>=1.4.2, <=1.7.0) +264 more potentially affected by CVE-2021-42697 via com.typesafe.akka:akka-http-core_2.12 (>=10.2.0-m1, <=10.2.6)

com.typesafe.akka:akka-http-core2.12 MAVEN version =10.2.0-m1, =1.1.0, =1.4.2, =1.4.2, =1.4.2, =1.4.2, =0.7.0, =0.7.0, =0.7.1, =0.7.0, =0.18.1, =5.0.0, =0.5.0, =0.5.0, =0.10.3, =0.10.3, =1.0.0 and more Source cves: CVE-2021-42697 Source advisory: GHSA-3HW2-H67C-WQ66...

ch.megard:akka-http-cors_2.12 (>=1.1.0, <=1.1.2), co.topl:akka-http-rpc_2.12 (>=1.4.2, <=1.7.0) +264 more potentially affected by CVE-2021-42697 via com.typesafe.akka:akka-http-core_2.12 (>=10.2.0-m1, <=10.2.6)

com.typesafe.akka:akka-http-core2.12 MAVEN version =10.2.0-m1, =1.1.0, =1.4.2, =1.4.2, =1.4.2, =1.4.2, =0.7.0, =0.7.0, =0.7.1, =0.7.0, =0.18.1, =5.0.0, =0.5.0, =0.5.0, =0.10.3, =0.10.3, =1.0.0 and more Source cves: CVE-2021-42697 Source advisory: OSV:GHSA-3HW2-H67C-WQ66...

Akka HTTP 10.1.14 Denial Of Service

Exploit Title: Akka HTTP Denial of Service via Nested Header Comments Date: 18/4/2022 Exploit Author: cxosmo Vendor Homepage: https://akka.io Software Link: https://github.com/akka/akka-http Version: Akka HTTP 10.1.x 10.1.15 & 10.2.x 10.2.7 Tested on: Akka HTTP 10.2.4, Ubuntu CVE : CVE-2021-42697...