CVE-2021-42697 Uncontrolled Recursion in Akka HTTP

What is CVE-2021-42697?

CVE-2021-42697 is a high-severity denial of service vulnerability in n/a, published on 2 Nov 2021. An attacker can exploit it over the internet without logging in, with no action from the victim.

Official description

Akka HTTP 10.1.x before 10.1.15 and 10.2.x before 10.2.7 can encounter stack exhaustion while parsing HTTP headers, which allows a remote attacker to conduct a Denial of Service attack by sending a User-Agent header with deeply nested comments.

Weakness: CWE-674

Which versions are affected by CVE-2021-42697?

18 open source packages ship an affected version, including com.typesafe.akka:akka-http-core_2.12, com.typesafe.akka:aakka-http-core_2.13.0-M3 and com.typesafe.akka:akka-http-core_2.11. It affects 1 product.

Products include Akka Http Server.

How do I fix CVE-2021-42697?

Upgrade com.typesafe.akka:akka-http-core_2.12 to a fixed version for your release line: 10.1.15 or 10.2.7.

Upgrade, then put limits on request size, rate and nesting depth so one client cannot exhaust the service. More about Denial of service.

Is CVE-2021-42697 being exploited?

There is no known exploitation of CVE-2021-42697 in the wild and no public exploit code.

Public exploit code: 1 Exploit-DB entry and 1 proofs of concept on GitHub.

Other vulnerabilities in n/a

• CVE-2023-44487 HTTP/2 Rapid Reset Attack Exploited High 7.5
• CVE-2017-1000118 Improper Restriction of Operations within the Bounds of a Memory Buffer in akka-http-core High 7.5

Sources

• CVE record
• NVD
• OSV
• GitHub advisory
• How this page is made

Also known as GHSA-3hw2-h67c-wq66.