Test ID:	1.3.6.1.4.1.25623.1.0.147110
Category:	Denial of Service
Title:	Akka HTTP < 10.2.7 DoS Vulnerability
Summary:	Akka HTTP is prone to a denial of service (DoS) vulnerability.
Description:	Summary: Akka HTTP is prone to a denial of service (DoS) vulnerability. Vulnerability Insight: The HTTP specification allows arbitrary nesting of comment elements in User-Agent and other headers. While parsing a request containing a User-Agent header with deeply nested comments, Akka HTTP may fail with a stack overflow in the parser. Stack overflows are handled as fatal errors in Akka leading to a complete shutdown of the application. Vulnerability Impact: An Akka HTTP application server which is exposed to the internet can be remotely crashed by sending a crafted User-Agent header leading to a loss of availability. Affected Software/OS: Akka HTTP prior to version 10.2.7. Solution: Update to version 10.2.7 or later. CVSS Score: 7.8 CVSS Vector: AV:N/AC:L/Au:N/C:N/I:N/A:C
Cross-Ref:	Common Vulnerability Exposure (CVE) ID: CVE-2018-16131 https://akka.io/blog/news/2018/08/30/akka-http-dos-vulnerability-found https://github.com/akka/akka-http/issues/2137 https://groups.google.com/forum/#!topic/akka-security/Dj7INsYWdjg
Copyright	Copyright (C) 2021 Greenbone Networks GmbH

This is only one of 145615 vulnerability tests in our test suite. Find out more about running a complete security audit. To run a free test of this vulnerability against your system, register below.