Search for packages
| purl | pkg:maven/com.typesafe.akka/akka-http-core@10.2.0 |
| Tags | Ghost |
| Next non-vulnerable version | None. |
| Latest non-vulnerable version | None. |
| Risk | 10.0 |
| Vulnerability | Summary | Fixed by |
|---|---|---|
|
VCID-9u45-d21t-b7fq
Aliases: CVE-2021-23339 GHSA-2w7w-2j92-44hx |
HTTP Request Smuggling in akka-http-core A vulnerable Akka HTTP server will accept a malformed message and hand it over to the user. If the user application proxies this message to another server unchanged and that server also accepts that message but interprets it as two HTTP messages, the second message has reached the second server without having been inspected by the proxy. |
Affected by 0 other vulnerabilities. |
|
VCID-w7g1-y7u7-z3fg
Aliases: CVE-2021-42697 GHSA-3hw2-h67c-wq66 |
Out-of-bounds Write Akka HTTP can encounter stack exhaustion while parsing HTTP headers, which allows a remote attacker to conduct a Denial of Service attack by sending a `User-Agent` header with deeply nested comments. |
Affected by 0 other vulnerabilities. |
| Vulnerability | Summary | Aliases |
|---|---|---|
| This package is not known to fix vulnerabilities. | ||
| Date | Actor | Action | Vulnerability | Source | VulnerableCode Version |
|---|---|---|---|---|---|
| 2026-04-02T16:56:38.445489+00:00 | GHSA Importer | Affected by | VCID-9u45-d21t-b7fq | https://github.com/advisories/GHSA-2w7w-2j92-44hx | 38.1.0 |
| 2026-04-01T12:48:59.490938+00:00 | GitLab Importer | Affected by | VCID-w7g1-y7u7-z3fg | https://gitlab.com/gitlab-org/advisories-community/-/blob/main/maven/com.typesafe.akka/akka-http-core/CVE-2021-42697.yml | 38.0.0 |