[MAVEN:GHSA-9QGC-P27W-3HJG] High severity vulnerability that affects com.typesafe.akka:akka-http-core_2.11 and com.typesafe.akka:akka-http-core_2.12

Severity High

Affected Packages 2

Fixed Packages 2

CVEs 1

The decodeRequest and decodeRequestWith directives in Lightbend Akka HTTP 10.1.x through 10.1.4 and 10.0.x through 10.0.13 allow remote attackers to cause a denial of service (memory consumption and daemon crash) via a ZIP bomb.

Package	Affected Version
pkg:maven/com.typesafe.akka/akka-http-core_2.12	>= 10.1.0, < 10.1.4
pkg:maven/com.typesafe.akka/akka-http-core_2.11	>= 10.1.0, < 10.1.4

Package	Fixed Version
pkg:maven/com.typesafe.akka/akka-http-core_2.12	= 10.1.4
pkg:maven/com.typesafe.akka/akka-http-core_2.11	= 10.1.4

ID: MAVEN:GHSA-9QGC-P27W-3HJG
Severity: high
URL: https://github.com/advisories/GHSA-9qgc-p27w-3hjg
Published: 2018-10-22T20:37:07
(5 years ago)
Modified: 2023-01-09T05:02:59
(20 months ago)
Rights: Maven Security Team

Source	# ID	Name	URL
			https://nvd.nist.gov/vuln/detail/CVE-2018-16131
			https://github.com/akka/akka-http/issues/2137
			https://akka.io/blog/news/2018/08/30/akka-http-dos-vulnerability-found
			https://doc.akka.io/docs/akka-http/current/security/2018-09-05-denial-of-service-via-decodeRequest.html
			https://github.com/advisories/GHSA-9qgc-p27w-3hjg
			https://groups.google.com/forum/#!topic/akka-security/Dj7INsYWdjg

Type	Package URL	Namespace	Name / Product	Version
Affected	pkg:maven/com.typesafe.akka/akka-http-core_2.12	com.typesafe.akka	akka-http-core_2.12	>= 10.1.0 < 10.1.4
Fixed	pkg:maven/com.typesafe.akka/akka-http-core_2.12	com.typesafe.akka	akka-http-core_2.12	= 10.1.4
Affected	pkg:maven/com.typesafe.akka/akka-http-core_2.11	com.typesafe.akka	akka-http-core_2.11	>= 10.1.0 < 10.1.4
Fixed	pkg:maven/com.typesafe.akka/akka-http-core_2.11	com.typesafe.akka	akka-http-core_2.11	= 10.1.4

# CVE	Description	CVSS	EPSS	EPSS Trend (30 days)	Affected Products	Weaknesses	Security Advisories	Exploits	PoC	Pubblication Date	Modification Date
# CVE	Description	CVSS	EPSS	EPSS Trend (30 days)	Affected Products	Weaknesses	Security Advisories	PoC	Pubblication Date	Modification Date