Akka Security

Contact owners and managers

1–13 of 13

Security alerts concerning the Akka library will be posted here.

Don't report any security issue publicly here!

--------------------------------------------------------------------------------------

We strongly encourage reporting such problems to our private
security mailing list at security@akka.io first, before disclosing them in a public forum.

This is to guard users affected by the vulnerability, while we work on a fix.

0 selected

patrik....@gmail.com

10/31/23

CVE-2023-45865: Akka logs environment variables

Date: 2023-10-31 CVE ID: CVE-2023-45865 Description of Vulnerability Environment variable values that

unread,

CVE-2023-45865: Akka logs environment variables

Date: 2023-10-31 CVE ID: CVE-2023-45865 Description of Vulnerability Environment variable values that

10/31/23

10/16/23

Akka HTTP: CVE-2023-44487: HTTP/2 rapid reset attack

Date: 2023-10-16 CVE ID: CVE-2023-44487 Description of Vulnerability A widespread HTTP/2 server

unread,

Akka HTTP: CVE-2023-44487: HTTP/2 rapid reset attack

Date: 2023-10-16 CVE ID: CVE-2023-44487 Description of Vulnerability A widespread HTTP/2 server

10/16/23

5/15/23

Akka HTTP uploaded file permissions

Date: 2023-05-15 CVE ID pending Description of Vulnerability When Akka HTTP prior to 10.5.2 accepts

unread,

Akka HTTP uploaded file permissions

Date: 2023-05-15 CVE ID pending Description of Vulnerability When Akka HTTP prior to 10.5.2 accepts

5/15/23

5/2/23

CVE-2023-31442 Insufficient protection against DNS poisoning

Akka Async DNS resolver has insufficient entropy to protect against DNS poisoning Date: 2023-05-02

unread,

CVE-2023-31442 Insufficient protection against DNS poisoning

Akka Async DNS resolver has insufficient entropy to protect against DNS poisoning Date: 2023-05-02

5/2/23

4/27/23

CVE-2023-29471: Alpakka Kafka logging credentials at debug

Date 2023-04-17 CVE CVE-2023-29471 Description of Vulnerability Credentials from org.apache.kafka.

unread,

CVE-2023-29471: Alpakka Kafka logging credentials at debug

Date 2023-04-17 CVE CVE-2023-29471 Description of Vulnerability Credentials from org.apache.kafka.

4/27/23

johannes...@gmail.com

11/2/21

CVE-2021-42697: Stack overflow while parsing User-Agent header with deeply nested comments

We were notified of a vulnerability in Akka HTTP <= 10.2.6. A new version of Akka HTTP, 10.2.7,

unread,

CVE-2021-42697: Stack overflow while parsing User-Agent header with deeply nested comments

We were notified of a vulnerability in Akka HTTP <= 10.2.6. A new version of Akka HTTP, 10.2.7,

11/2/21

johannes.rudolph

9/6/18

Denial of Service via unlimited decoding with decodeRequest directive (“zip bomb”), please update to Akka HTTP 10.1.5 or 10.0.14

CVE-2018-16131: Denial of Service via unlimited decoding with decodeRequest directive (“zip bomb”)

unread,

Denial of Service via unlimited decoding with decodeRequest directive (“zip bomb”), please update to Akka HTTP 10.1.5 or 10.0.14

CVE-2018-16131: Denial of Service via unlimited decoding with decodeRequest directive (“zip bomb”)

9/6/18

johannes.rudolph

8/30/18

Akka Http 10.0.x / 10.1.x DoS vulnerability found

Date 2018-08-30 Description Directives decodeRequest and decodeRequestWith which handle compressed

unread,

Akka Http 10.0.x / 10.1.x DoS vulnerability found

Date 2018-08-30 Description Directives decodeRequest and decodeRequestWith which handle compressed

8/30/18

Patrik Nordwall

8/29/18

Broken random number generators AES128CounterSecureRNG / AES256CounterSecureRNG

CVE ID CVE-2018-16115 Date 29 August 2018 Description of Vulnerability A random number generator is

unread,

Broken random number generators AES128CounterSecureRNG / AES256CounterSecureRNG

CVE ID CVE-2018-16115 Date 29 August 2018 Description of Vulnerability A random number generator is

8/29/18

Patrik Nordwall

8/10/17

Camel Dependency

Date 9 August 2017 Description of Vulnerability Apache Camel's Validation Component is vulnerable

unread,

Camel Dependency

Date 9 August 2017 Description of Vulnerability Apache Camel's Validation Component is vulnerable

8/10/17

Konrad Malawski

5/3/17

Akka HTTP: Illegal Media Range in Accept Header Causes StackOverflowError Leading to Denial of Service

Dear Lightbend Subscribers and users of Akka HTTP, This announcement is to notify you of the

unread,

Akka HTTP: Illegal Media Range in Accept Header Causes StackOverflowError Leading to Denial of Service

Dear Lightbend Subscribers and users of Akka HTTP, This announcement is to notify you of the

5/3/17

Patrik Nordwall2

2/15/17

Java Deserialization Vulnerability

The CVSS score of this vulnerability has been updated to 6.8 (Medium), based on vector AV:A/AC:M/Au:N

unread,

Java Deserialization Vulnerability

The CVSS score of this vulnerability has been updated to 6.8 (Medium), based on vector AV:A/AC:M/Au:N

2/15/17

Konrad Malawski

1/23/17

Denial-of-Service by stream leak on unconsumed closed connections

Date 23 January 2017 Description of Vulnerability For requests containing request bodies (including

unread,

Denial-of-Service by stream leak on unconsumed closed connections

Date 23 January 2017 Description of Vulnerability For requests containing request bodies (including

1/23/17

Search

Clear search

Close search

Google apps

Main menu