Cross-site Request Forgery (CSRF)

Overview Affected versions of this package are vulnerable to Cross-site Request Forgery CSRF. For older versions, endpoints protected by randomTokenCsrfProtection could be bypassed with an empty X-XSRF-TOKEN header and an empty XSRF-TOKEN cookie. Remediation Upgrade...

Cross-site Scripting (XSS)

akka-http is vulnerable to cross-site scripting XSS attacks. The vulnerability exists as raw queries were being shown on the error message, allowing XSS attacks...

ba.sake:hepek-play_2.12 (>=0.4.0 <=0.4.1), by.exonit:swagger-play2-play26_2.12 (=1.0.0) +365 more potentially affected by CVE-2017-1000118 via com.typesafe.akka:akka-http-core_2.12 (>=10.0.0-RC2 <=10.0.5)

com.typesafe.akka:akka-http-core2.12 MAVEN version =10.0.0-RC2, =0.4.0, =0.3.0, =0.1.0, =0.1.9, =0.0.10, =1.4-P26, =1.4-P26-B3, =2.0.0, =0.1.4, =0.2.0, =0.2.0, =0.3.0-RC6 and more Source cves: CVE-2017-1000118 Source advisory: OSV:GHSA-GFX6-PH4Q-Q54Q...

Improper Restriction of Operations within the Bounds of a Memory Buffer in akka-http-core

Akka HTTP versions = 10.0.5 Illegal Media Range in Accept Header Causes StackOverflowError Leading to Denial of Service...

GHSA-GFX6-PH4Q-Q54Q Improper Restriction of Operations within the Bounds of a Memory Buffer in akka-http-core

Akka HTTP versions = 10.0.5 Illegal Media Range in Accept Header Causes StackOverflowError Leading to Denial of Service...

Akka Java Serialization vulnerability

Akka versions =2.4.16 and 2.5-M1 are vulnerable to a java deserialization attack in its Remoting component resulting in remote code execution in the context of the ActorSystem...

GHSA-MM57-9J6Q-RXM2 Akka Java Serialization vulnerability

Akka versions =2.4.16 and 2.5-M1 are vulnerable to a java deserialization attack in its Remoting component resulting in remote code execution in the context of the ActorSystem...

Cryptographically Weak Pseudo-Random Number Generator (PRNG) in akka-actor

Lightbend Akka 2.5.x before 2.5.16 allows message disclosure and modification because of an RNG error. A random number generator is used in Akka Remoting for TLS both classic and Artery Remoting. Akka allows configuration of custom random number generators. For historical reasons, Akka included t...

be.venneborg:play26-refined_2.11 (>=0.2.0 <=0.3.0), be.venneborg:play27-refined_2.11 (=0.3.0) +573 more potentially affected by CVE-2018-16115 via com.typesafe.akka:akka-actor_2.11 (>=2.5.0 <=2.5.15)

com.typesafe.akka:akka-actor2.11 MAVEN version =2.5.0, =0.2.0, =0.1.1, =1.4-P26-B3, =1.4-P26-B4 - com.andrewgapic:spark-streaming-twitch =1.0.0 and more Source cves: CVE-2018-16115 Source advisory: OSV:GHSA-MR95-9RR4-668F...

ai.agnos:reactive-sparql_2.12 (>=0.3.0 <=0.3.1), ai.snips:play-mongo-bson_2.12 (>=0.5 <=0.5.1) +1141 more potentially affected by CVE-2018-16115 via com.typesafe.akka:akka-actor_2.12 (>=2.5.0 <=2.5.15)

com.typesafe.akka:akka-actor2.12 MAVEN version =2.5.0, =0.3.0, =0.5, =0.2.0, =0.1.0, =0.1.0, =0.14.0, =0.17.0 and more Source cves: CVE-2018-16115 Source advisory: OSV:GHSA-MR95-9RR4-668F...

GHSA-MR95-9RR4-668F Cryptographically Weak Pseudo-Random Number Generator (PRNG) in akka-actor

Lightbend Akka 2.5.x before 2.5.16 allows message disclosure and modification because of an RNG error. A random number generator is used in Akka Remoting for TLS both classic and Artery Remoting. Akka allows configuration of custom random number generators. For historical reasons, Akka included t...

ai.agnos:reactive-sparql_2.12 (>=0.3.0 <=0.3.1), ai.lum:odinson-rest-api_2.12 (>=0.3.1 <=0.5.0) +647 more potentially affected by CVE-2018-16131 via com.typesafe.akka:akka-http-core_2.12 (>=10.1.0 <=10.1.3)

com.typesafe.akka:akka-http-core2.12 MAVEN version =10.1.0, =0.3.0, =0.3.1, =0.3.0, =0.3.0, =0.3.0, =0.3.0, =0.3.0, =0.3.0, =0.3.0, =0.3.0, =0.3.0, =0.3.0, =0.3.0, =0.3.0, =0.3.0, =0.3.1-rc1 and more Source cves: CVE-2018-16131 Source advisory: OSV:GHSA-9QGC-P27W-3HJG...

High severity vulnerability that affects com.typesafe.akka:akka-http-core_2.11 and com.typesafe.akka:akka-http-core_2.12

The decodeRequest and decodeRequestWith directives in Lightbend Akka HTTP 10.1.x through 10.1.4 and 10.0.x through 10.0.13 allow remote attackers to cause a denial of service memory consumption and daemon crash via a ZIP bomb...

GHSA-9QGC-P27W-3HJG High severity vulnerability that affects com.typesafe.akka:akka-http-core_2.11 and com.typesafe.akka:akka-http-core_2.12

The decodeRequest and decodeRequestWith directives in Lightbend Akka HTTP 10.1.x through 10.1.4 and 10.0.x through 10.0.13 allow remote attackers to cause a denial of service memory consumption and daemon crash via a ZIP bomb...

com.holidaycheck:amqp-akka-streams_2.11 (>=1.3.1 <=2.0.0), com.holidaycheck:amqp-akka-streams_2.12 (>=1.3.1 <=2.0.0) +1 more potentially affected by CVE-2017-15701 via org.apache.qpid:qpid-broker (>=6.1.3 <=6.1.4)

org.apache.qpid:qpid-broker MAVEN version =6.1.3, =1.3.1, =1.3.1, =0.0.1, =0.0.35 Source cves: CVE-2017-15701 Source advisory: OSV:GHSA-4R7G-7CPJ-5JR7...

Directory Traversal

akka-http is vulnerable to directory traversal attacks. The vulnerability exists due to the lack of sanitization of the resource path, allowing directory traversal in windows deployments...

Insecure Random Number Generation

akka-remote is vulnerable to insecure random number generation. When a custom random number generator is configured, if the AES128CounterSecureRNG and AES256CounterSecureRNG are enabled, a malicious user can easily guess the random number used during encryption and possibly eavesdrop onto ongoing...

Denial Of Service (DoS) Via Zip Bomb

akka-http is vulnerable to denial of service via a Zip Bomb. The vulnerability is caused by the application not having size limitations on decompressed data from the directives decodeRequest and decodeRequestWith or when using them in combination with directives like entityas, toStrict, or...

Akka HTTP 10.0.x, 10.1.x Denial of Service vulnerability

Akka HTTP is prone to a Denial of Service vulnerability. SPDX-FileCopyrightText: 2018 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only if description...

CVE-2018-16131

The decodeRequest and decodeRequestWith directives in Lightbend Akka HTTP 10.1.x through 10.1.4 and 10.0.x through 10.0.13 allow remote attackers to cause a denial of service memory consumption and daemon crash via a ZIP bomb...