CVE-2021-23339 HTTP Request Smuggling
Attackers can exploit HTTP request smuggling in Akka HTTP by sending multiple Transfer-Encoding headers, potentially bypassing security controls.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- A user has to click or open something
- Fix
- Available
What is CVE-2021-23339?
CVE-2021-23339 is a medium-severity vulnerability in com.typesafe.akka:akka-http-core, published on 17 Feb 2021. An attacker can exploit it over the internet without logging in, and only if a user opens a file or follows a link.
Official description
This affects all versions before 10.1.14 and from 10.2.0 to 10.2.4 of package com.typesafe.akka:akka-http-core. It allows multiple Transfer-Encoding headers.
Weakness: CWE-444
Which versions are affected by CVE-2021-23339?
4 open source packages ship an affected version, including com.typesafe.akka:akka-http-core. It affects 1 product.
| Package | Affected | Fixed in |
|---|---|---|
com.typesafe.akka:akka-http-core Maven | All versions | 10.1.14 |
com.typesafe.akka:akka-http-core Maven | All versions | 10.1.14 |
com.typesafe.akka:akka-http-core Maven | From 10.2.0 | 10.2.4 |
com.typesafe.akka:akka-http-core Maven | From 10.2.0 | 10.2.4 |
Products include Lightbend Akka-Http.
How do I fix CVE-2021-23339?
Upgrade com.typesafe.akka:akka-http-core to a fixed version for your release line: 10.1.14 or 10.2.4.
Is CVE-2021-23339 being exploited?
There is no known exploitation of CVE-2021-23339 in the wild and no public exploit code.
Sources
Also known as GHSA-2w7w-2j92-44hx, SNYK-JAVA-COMTYPESAFEAKKA-1075043.