Read the docs
TI-2017-14455 Aliases CVE-2017-1000118GHSA-gfx6-ph4q-q54q

Akka HTTP versions <= 10.0.5 Illegal Media Range in Accept Header Causes StackOverflowError Leading to Denial of Service

Priority LOW 35CWE-119Published · Updated

Key facts

Attack vector
Network
Privileges required
None
User interaction
None
Attack complexity
Low
Impact type
Denial of service
Confidentiality · integrity · availability
None · None · High
Fix status
Fixed

Attack profile from CVSS 3.0 · NVD. Fix status from CNA and GitHub. Impact type from CWE-119 and the CVSS impact.

Summary

Akka HTTP versions <= 10.0.5 Illegal Media Range in Accept Header Causes StackOverflowError Leading to Denial of Service

Why it matters now

EPSS 0.01103 65th percentileScored 2026-11-07
Fix Fixed com.typesafe.akka:akka-http-core_2.12 (Maven): 10.0.6com.typesafe.akka:akka-http-core_2.11 (Maven): 10.0.6

SSVC decision points

Not available: CISA has not published SSVC decision points for this record.

Affected products

VendorProductAffected versionsFixed inStatusSource
——all versions—No fix listedCNA
—com.typesafe.akka:akka-http-core_2.12 (Maven)before 10.0.610.0.6Patch availableGHSA-gfx6-ph4q-q54q
—com.typesafe.akka:akka-http-core_2.11 (Maven)before 10.0.610.0.6Patch availableGHSA-gfx6-ph4q-q54q
  • — Vendor— Affected all versions Fixed in — No fix listed CNA
  • com.typesafe.akka:akka-http-core_2.12 (Maven) Vendor— Affected before 10.0.6 Fixed in 10.0.6 Patch available GHSA-gfx6-ph4q-q54q
  • com.typesafe.akka:akka-http-core_2.11 (Maven) Vendor— Affected before 10.0.6 Fixed in 10.0.6 Patch available GHSA-gfx6-ph4q-q54q

CPE configurations NVD · 1

CPEVersionsRoleVendor
cpe:2.3:a:akka:http_server:*:*:*:*:*:*:*:*up to 10.0.5VulnerableAkka
  • cpe:2.3:a:akka:http_server:*:*:*:*:*:*:*:* Versions up to 10.0.5 Vulnerable ·Akka

Remediation

  • Fix · GHSA-gfx6-ph4q-q54q com.typesafe.akka:akka-http-core_2.12 (Maven) Fixed in 10.0.6 Advisory →
  • Fix · GHSA-gfx6-ph4q-q54q com.typesafe.akka:akka-http-core_2.11 (Maven) Fixed in 10.0.6 Advisory →

Timeline

  1. 2026-10-02 Threatist record created from CVE-2017-1000118
  2. 2026-10-03 Alias added: GHSA-gfx6-ph4q-q54q

References

Advisory 3

  • TI-2023-23979 The HTTP/2 protocol allows a denial of service (server resource consumption) because… KEVCVSS 3.1HIGH 7.5
  • TI-2021-18910 Akka HTTP 10.1.x before 10.1.15 and 10.2.x before 10.2.7 can encounter stack exhaustion… CVSS 3.1HIGH 7.5

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences