TI-2025-33344 CVE-2025-53393 · GHSA-358m-fq53-hp87
In Akka through 2.10.6, akka-cluster-metrics uses Java serialization for cluster metrics.
Priority LOW 26
In Akka through 2.10.6, akka-cluster-metrics uses Java serialization for cluster metrics.
Vulnerabilities
6 records
TI-2025-29266 CVE-2025-46548 · GHSA-9qvj-rpj8-v5c8
Improper authentication in Apache Pekko Management
Priority LOW 30
If you enable Basic Authentication in Pekko Management using the Java DSL, the authenticator may not be properly applied.
TI-2023-23979 CVE-2023-44487 · GHSA-qppj-fm5r-hxr3
The HTTP/2 protocol allows a denial of service (server resource consumption) because…
Priority CRITICAL 90KEV
The HTTP/2 protocol allows a denial of service (server resource consumption) because request cancellation can reset many streams quickly, as exploited in the wild in August through October 2023.
TI-2021-18910 CVE-2021-42697 · GHSA-3hw2-h67c-wq66
Akka HTTP 10.1.x before 10.1.15 and 10.2.x before 10.2.7 can encounter stack exhaustion…
Priority MEDIUM 59
Akka HTTP 10.1.x before 10.1.15 and 10.2.x before 10.2.7 can encounter stack exhaustion while parsing HTTP headers, which allows a remote attacker to conduct a Denial of Service attack by sending a User-Agent header with…
TI-2017-14455 CVE-2017-1000118 · GHSA-gfx6-ph4q-q54q
Akka HTTP versions <= 10.0.5 Illegal Media Range in Accept Header Causes StackOverflowError Leading to Denial of Service
Priority LOW 35
Akka HTTP versions <= 10.0.5 Illegal Media Range in Accept Header Causes StackOverflowError Leading to Denial of Service
TI-2017-14380 CVE-2017-1000034 · GHSA-mm57-9j6q-rxm2
Akka versions <=2.4.16 and 2.5-M1 are vulnerable to a java deserialization attack in its…
Priority MEDIUM 44
Akka versions <=2.4.16 and 2.5-M1 are vulnerable to a java deserialization attack in its Remoting component resulting in remote code execution in the context of the ActorSystem.