CVE-2021-42697

Akka HTTP 10.1.x10.1.15 미만 및 10.2.x10.2.7 미만는 HTTP 헤더를 파싱하는 동안 스택 고갈stack exhaustion이 발생할 수 있으며, 이로 인해 원격 공격자가 깊이 중첩된 주석이 포함된 User-Agent 헤더를 전송하여 서비스 거부DoS 공격을 수행할 수 있습니다. 참고 자료 MITRE Akka 블로그 주석의 임의 중첩 기본 Akka 설정 가이드 PoC 참고 사항 테스트 대상 버전: 10.2.4 대상 서버 핑거프린트: akka-http/ 페이로드 스니펫: User-Agent:...

CVE-2026-46682 BigBlueButton: Blind SQL Injection AUTH (Moderator)

BigBlueButton is an open-source virtual classroom. Prior to 3.0.23, BigBlueButton allowed authenticated moderators to inject SQL through the meetingId and userId values used by refreshBreakoutRoomsVisibleForUsers in akka-bbb-apps/src/main/scala/org/bigbluebutton/core/db/BreakoutRoomUserDAO.scala...

CVE-2026-46682: Improper Neutralization of Special Elements used in an SQL Command

BigBlueButton is an open-source virtual classroom. Prior to 3.0.23, BigBlueButton allowed authenticated moderators to inject SQL through the meetingId and userId values used by refreshBreakoutRoomsVisibleForUsers in akka-bbb-apps/src/main/scala/org/bigbluebutton/core/db/BreakoutRoomUserDAO.scala...

CVE-2023-31442

In Lightbend Akka before 2.8.1, the async-dns resolver used by Discovery in DNS mode and transitively by Cluster Bootstrap uses predictable DNS transaction IDs when resolving DNS records, making DNS resolution subject to poisoning by an attacker. If the application performing discovery does not...

The vulnerability of the Cluster Metrics Handler component in the toolkit for creating highly competitive, distributed, and fault-tolerant applications allows a hacker to execute remote code.

The vulnerability of the Cluster Metrics Handler component in the Akka toolset for creating highly competitive, distributed, and fault-tolerant applications is related to deficiencies in the deserialization mechanism. Exploiting this vulnerability allows a remote attacker to execute arbitrary cod...

Improper Authentication

Akka.NET is vulnerable to improper authentication. The vulnerability is due to the lack of mutual TLS enforcement in Akka.Remote, which allows an attacker to connect to a TLS-enabled cluster without presenting a valid client certificate and thereby communicate with the cluster...

Akka.Remote TLS did not properly implement certificate-based authentication

Impact This is a critical network security vulnerability for Akka.Remote users who have SSL / TLS enabled on their Akka.Remote connections and were expecting certificate-based authentication to be enforced on all peers attempting to join the network. In all versions of Akka.Remote from v1.2.0 to...

GHSA-JHPV-4Q4F-43G5 Akka.Remote TLS did not properly implement certificate-based authentication

Impact This is a critical network security vulnerability for Akka.Remote users who have SSL / TLS enabled on their Akka.Remote connections and were expecting certificate-based authentication to be enforced on all peers attempting to join the network. In all versions of Akka.Remote from v1.2.0 to...

EUVD-2025-32561

Akka.Remote TLS did not properly implement certificate-based authentication...

CVE-2025-61778

Akka.NET is a .NET port of the Akka project from the Scala / Java community. In all versions of Akka.Remote from v1.2.0 to v1.5.51, TLS could be enabled via our akka.remote.dot-netty.tcp transport and this would correctly enforce private key validation on the server-side of inbound connections...

EUVD-2018-0565

Malware in sbrugna...

EUVD-2018-0601

Malware in sbrugna...

EUVD-2021-0909

Malware in sbrugna...

EUVD-2018-0642

Malware in sbrugna...

EUVD-2018-0643

Malware in sbrugna...

Akka.Remote TLS did not properly implement certificate-based authentication

This is a critical network security vulnerability for Akka.Remote users who have SSL / TLS enabled on their Akka.Remote connections and were expecting certificate-based authentication to be enforced on all peers attempting to join the network. In all versions of Akka.Remote from v1.2.0 to v1.5.51...

Akka.Remote TLS did not properly implement certificate-based authentication

This is a critical network security vulnerability for Akka.Remote users who have SSL / TLS enabled on their Akka.Remote connections and were expecting certificate-based authentication to be enforced on all peers attempting to join the network. In all versions of Akka.Remote from v1.2.0 to v1.5.51...

User Impersonation

Overview Akka.Remote is a .NET port of the popular Akka project from the Scala / Java community. Affected versions of this package are vulnerable to User Impersonation due to improper implementation of certificate-based authentication in the akka.remote.dot-netty.tcp transport. An attacker can ga...

CVE-2025-61778 Akka.Remote TLS did not properly implement certificate-based authentication

Akka.NET is a .NET port of the Akka project from the Scala / Java community. In all versions of Akka.Remote from v1.2.0 to v1.5.51, TLS could be enabled via our akka.remote.dot-netty.tcp transport and this would correctly enforce private key validation on the server-side of inbound connections...

CVE-2025-61778 Akka.Remote TLS did not properly implement certificate-based authentication

Akka.NET is a .NET port of the Akka project from the Scala / Java community. In all versions of Akka.Remote from v1.2.0 to v1.5.51, TLS could be enabled via our akka.remote.dot-netty.tcp transport and this would correctly enforce private key validation on the server-side of inbound connections...