← back
CVE-2021-42697

CVE-2021-42697

EPSS 36.1%
Akka HTTP 10.1.x before 10.1.15 and 10.2.x before 10.2.7 can encounter stack exhaustion while parsing HTTP headers, which allows a remote attacker to conduct a Denial of Service attack by sending a User-Agent header with deeply nested comments.
Affected products
n/a · n/a
public PoCs found — 3
githubgithub.com/cxosmo/CVE-2021-42697★ 1cve_referencepacketstormsecurity.com/files/167018/Akka-HTTP-10.1.14-Denial-Of-Service.htmlunverifiedexploitdbwww.exploit-db.com/exploits/50892unverified
⚠ Public resources, to assess the exposure of systems you control or are authorized to test. Test only with authorization.

Want to know if your infrastructure is exposed to this?

Talk to TrueHacking →
References
http://packetstormsecurity.com/files/167018/Akka-HTTP-10.1.14-Denial-Of-Service.htmlhttps://akka.io/blog/https://akka.io/blog/news/2021/11/02/akka-http-10.2.7-releasedhttps://akka.io/blog/news/2021/11/22/akka-http-10.1.15-releasedhttps://doc.akka.io/docs/akka-http/current/security/2021-CVE-2021-42697-stack-overflow-parsing-user-agent.html