Public exploit available
Public proof-of-concept or exploit code exists (ExploitDB / Metasploit / Nuclei).

CVE-2021-42697 — Uncontrolled Recursion in Http Server

CWE-674 — Uncontrolled RecursionCWE-787 — Out-of-bounds Write5 documents5 sources
Severity
7.5HIGHNVD
EPSS
75.5%
top 1.10%
CISA KEV
Not in KEV
Exploit
PoC available
Public exploit / PoC exists
Affected products
1
Akka Http Server
Timeline
PublishedNov 2
Latest updateMay 24

Description

Akka HTTP 10.1.x before 10.1.15 and 10.2.x before 10.2.7 can encounter stack exhaustion while parsing HTTP headers, which allows a remote attacker to conduct a Denial of Service attack by sending a User-Agent header with deeply nested comments.

CVSS vector

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:HExploitability: 3.9 | Impact: 3.6

Affected Packages1 packages

▶NVDakka/http_server10.1.0 — 10.1.15+1

🔴Vulnerability Details

3
OSV
Uncontrolled Recursion in Akka HTTP↗2022-05-24
▶
GHSA
Uncontrolled Recursion in Akka HTTP↗2022-05-24
▶
CVEList
CVE-2021-42697: Akka HTTP 10↗2021-11-02
▶

💥Exploits & PoCs

1
Exploit-DB
Akka HTTP 10.1.14 - Denial of Service↗2022-05-11
▶
CVE-2021-42697 — Uncontrolled Recursion in Http Server | cvebase