Read the docs
TI-2018-11525 Aliases CVE-2018-16115GHSA-mr95-9rr4-668f

Lightbend Akka 2.5.x before 2.5.16 allows message disclosure and modification because of…

Priority MEDIUM 42CWE-338Published · Updated

Key facts

Attack vector
Network
Privileges required
None
User interaction
None
Attack complexity
Low
Impact type
—
Confidentiality · integrity · availability
High · High · None
Fix status
Fixed

Attack profile from CVSS 3.0 · NVD. Fix status from CNA and GitHub.

Summary

Lightbend Akka 2.5.x before 2.5.16 allows message disclosure and modification because of an RNG error. A random number generator is used in Akka Remoting for TLS (both classic and Artery Remoting). Akka allows configuration of custom random number generators. For historical reasons, Akka included the AES128CounterSecureRNG and AES256CounterSecureRNG random number generators. The implementations had a bug that caused the generated numbers to be repeated after only a few bytes. The custom RNG implementations were not configured by default but examples in the documentation showed (and therefore implicitly recommended) using the custom ones. This can be used by an attacker to compromise the communication if these random number generators are enabled in configuration. It would be possible to eavesdrop, replay, or modify the messages sent with Akka Remoting/Cluster.

Why it matters now

EPSS 0.01186 68th percentileScored 2026-11-07
Fix Fixed com.typesafe.akka:akka-actor_2.11 (Maven): 2.5.16com.typesafe.akka:akka-actor_2.12 (Maven): 2.5.16

SSVC decision points

Not available: CISA has not published SSVC decision points for this record.

Affected products

VendorProductAffected versionsFixed inStatusSource
——all versions—No fix listedCNA
—com.typesafe.akka:akka-actor_2.11 (Maven)2.5.0 to before 2.5.162.5.16Patch availableGHSA-mr95-9rr4-668f
—com.typesafe.akka:akka-actor_2.12 (Maven)2.5.0 to before 2.5.162.5.16Patch availableGHSA-mr95-9rr4-668f
  • — Vendor— Affected all versions Fixed in — No fix listed CNA
  • com.typesafe.akka:akka-actor_2.11 (Maven) Vendor— Affected 2.5.0 to before 2.5.16 Fixed in 2.5.16 Patch available GHSA-mr95-9rr4-668f
  • com.typesafe.akka:akka-actor_2.12 (Maven) Vendor— Affected 2.5.0 to before 2.5.16 Fixed in 2.5.16 Patch available GHSA-mr95-9rr4-668f

CPE configurations NVD · 1

CPEVersionsRoleVendor
cpe:2.3:a:lightbend:akka:*:*:*:*:*:*:*:*2.5.0 to before 2.5.16VulnerableLightbend
  • cpe:2.3:a:lightbend:akka:*:*:*:*:*:*:*:* Versions 2.5.0 to before 2.5.16 Vulnerable ·Lightbend

Remediation

  • Fix · GHSA-mr95-9rr4-668f com.typesafe.akka:akka-actor_2.11 (Maven) Fixed in 2.5.16 Advisory →
  • Fix · GHSA-mr95-9rr4-668f com.typesafe.akka:akka-actor_2.12 (Maven) Fixed in 2.5.16 Advisory →

Timeline

  1. 2026-10-02 Threatist record created from CVE-2018-16115
  2. 2026-10-03 Alias added: GHSA-mr95-9rr4-668f

References

Advisory 3

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences