Read the docs
TI-2021-18910 Aliases CVE-2021-42697GHSA-3hw2-h67c-wq66

Akka HTTP 10.1.x before 10.1.15 and 10.2.x before 10.2.7 can encounter stack exhaustion…

Priority MEDIUM 59CWE-674Published · Updated

Key facts

Attack vector
Network
Privileges required
None
User interaction
None
Attack complexity
Low
Impact type
Denial of service
Confidentiality · integrity · availability
None · None · High
Fix status
Fixed

Attack profile from CVSS 3.1 · NVD. Fix status from CNA and GitHub. Impact type from CWE-674.

Summary

Akka HTTP 10.1.x before 10.1.15 and 10.2.x before 10.2.7 can encounter stack exhaustion while parsing HTTP headers, which allows a remote attacker to conduct a Denial of Service attack by sending a User-Agent header with deeply nested comments.

Why it matters now

EPSS 0.36139 98th percentileScored 2026-11-07
Public exploit Yes 1 exploit referenceTagged by NVD
Fix Fixed com.typesafe.akka:akka-http-core_2.13 (Maven): 10.1.15, 10.2.7com.typesafe.akka:akka-http-core_2.12 (Maven): 10.1.15, 10.2.7+1 more product

SSVC decision points

Not available: CISA has not published SSVC decision points for this record.

Affected products

VendorProductAffected versionsFixed inStatusSource
——all versions—No fix listedCNA
—com.typesafe.akka:akka-http-core_2.13.0-RC3 (Maven)10.1.0 and later—No fix listedGHSA-3hw2-h67c-wq66
—com.typesafe.akka:akka-http-core_2.13.0-RC2 (Maven)10.1.0 and later—No fix listedGHSA-3hw2-h67c-wq66
—com.typesafe.akka:akka-http-core_2.13.0-M5 (Maven)10.1.0 and later—No fix listedGHSA-3hw2-h67c-wq66
—com.typesafe.akka:aakka-http-core_2.13.0-M3 (Maven)10.1.0 and later—No fix listedGHSA-3hw2-h67c-wq66
—com.typesafe.akka:akka-http-core_2.13 (Maven)10.1.0 to before 10.1.1510.1.15Patch availableGHSA-3hw2-h67c-wq66
—com.typesafe.akka:akka-http-core_2.13 (Maven)10.2.0-M1 to before 10.2.710.2.7Patch availableGHSA-3hw2-h67c-wq66
—com.typesafe.akka:akka-http-core_2.12 (Maven)10.1.0 to before 10.1.1510.1.15Patch availableGHSA-3hw2-h67c-wq66
—com.typesafe.akka:akka-http-core_2.12 (Maven)10.2.0-M1 to before 10.2.710.2.7Patch availableGHSA-3hw2-h67c-wq66
—com.typesafe.akka:akka-http-core_2.11 (Maven)10.1.0 to before 10.1.1510.1.15Patch availableGHSA-3hw2-h67c-wq66
  • — Vendor— Affected all versions Fixed in — No fix listed CNA
  • com.typesafe.akka:akka-http-core_2.13.0-RC3 (Maven) Vendor— Affected 10.1.0 and later Fixed in — No fix listed GHSA-3hw2-h67c-wq66
  • com.typesafe.akka:akka-http-core_2.13.0-RC2 (Maven) Vendor— Affected 10.1.0 and later Fixed in — No fix listed GHSA-3hw2-h67c-wq66
  • com.typesafe.akka:akka-http-core_2.13.0-M5 (Maven) Vendor— Affected 10.1.0 and later Fixed in — No fix listed GHSA-3hw2-h67c-wq66
  • com.typesafe.akka:aakka-http-core_2.13.0-M3 (Maven) Vendor— Affected 10.1.0 and later Fixed in — No fix listed GHSA-3hw2-h67c-wq66
  • com.typesafe.akka:akka-http-core_2.13 (Maven) Vendor— Affected 10.1.0 to before 10.1.15 Fixed in 10.1.15 Patch available GHSA-3hw2-h67c-wq66
  • com.typesafe.akka:akka-http-core_2.13 (Maven) Vendor— Affected 10.2.0-M1 to before 10.2.7 Fixed in 10.2.7 Patch available GHSA-3hw2-h67c-wq66
  • com.typesafe.akka:akka-http-core_2.12 (Maven) Vendor— Affected 10.1.0 to before 10.1.15 Fixed in 10.1.15 Patch available GHSA-3hw2-h67c-wq66
  • com.typesafe.akka:akka-http-core_2.12 (Maven) Vendor— Affected 10.2.0-M1 to before 10.2.7 Fixed in 10.2.7 Patch available GHSA-3hw2-h67c-wq66
  • com.typesafe.akka:akka-http-core_2.11 (Maven) Vendor— Affected 10.1.0 to before 10.1.15 Fixed in 10.1.15 Patch available GHSA-3hw2-h67c-wq66

CPE configurations NVD · 1

CPEVersionsRoleVendor
cpe:2.3:a:akka:http_server:*:*:*:*:*:*:*:*10.1.0 to before 10.1.15; 10.2.0 to before 10.2.7VulnerableAkka
  • cpe:2.3:a:akka:http_server:*:*:*:*:*:*:*:* Versions 10.1.0 to before 10.1.15; 10.2.0 to before 10.2.7 Vulnerable ·Akka

Remediation

  • Fix · GHSA-3hw2-h67c-wq66 com.typesafe.akka:akka-http-core_2.13 (Maven) Fixed in 10.1.15 Advisory →
  • Fix · GHSA-3hw2-h67c-wq66 com.typesafe.akka:akka-http-core_2.13 (Maven) Fixed in 10.2.7 Advisory →
  • Fix · GHSA-3hw2-h67c-wq66 com.typesafe.akka:akka-http-core_2.12 (Maven) Fixed in 10.1.15 Advisory →
  • Fix · GHSA-3hw2-h67c-wq66 com.typesafe.akka:akka-http-core_2.12 (Maven) Fixed in 10.2.7 Advisory →
  • Fix · GHSA-3hw2-h67c-wq66 com.typesafe.akka:akka-http-core_2.11 (Maven) Fixed in 10.1.15 Advisory →

Timeline

  1. 2026-10-02 Threatist record created from CVE-2021-42697
  2. 2026-10-03 Alias added: GHSA-3hw2-h67c-wq66

References

Exploit 1

Advisory 5

Other 3

  • TI-2023-23979 The HTTP/2 protocol allows a denial of service (server resource consumption) because… KEVCVSS 3.1HIGH 7.5
  • TI-2017-14455 Akka HTTP versions <= 10.0.5 Illegal Media Range in Accept Header Causes StackOverflowError Leading to Denial of Service CVSS 3.0HIGH 7.5

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences