Skip to content
OpenAdvisories
High · 7.5 CVE-2018-16131 EUVD-2018-0565GHSA-9qgc-p27w-3hjg

High severity vulnerability that affects com.typesafe.akka:akka-http-core_2.11 and com.typesafe.akka:akka-http-core_2.12

Published Aug 30, 2018 · Updated Aug 5, 2024 · Assigned by mitre

Package: com.typesafe.akka:akka-http-core_2.11 Package: com.typesafe.akka:akka-http-core_2.12 Ecosystem: Maven

Description

The decodeRequest and decodeRequestWith directives in Lightbend Akka HTTP 10.1.x through 10.1.4 and 10.0.x through 10.0.13 allow remote attackers to cause a denial of service (memory consumption and daemon crash) via a ZIP bomb.

Affected packages

EcosystemPackageAffectedFixedRecord
Maven com.typesafe.akka:akka-http-core_2.11 >= 10.1.0, < 10.1.4 10.1.4 GHSA-9qgc-p27w-3hjg
Maven com.typesafe.akka:akka-http-core_2.12 >= 10.1.0, < 10.1.4 10.1.4 GHSA-9qgc-p27w-3hjg

References