CVE-2021-23339
HTTP Request Smuggling
This affects all versions before 10.1.14 and from 10.2.0 to 10.2.4 of package com.typesafe.akka:akka-http-core. It allows multiple Transfer-Encoding headers.
Attack profile
How easy it is to exploit
- Attack vector
- Network
- Complexity
- High
- Privileges needed
- None
- User interaction
- Required
What an attacker can affect
- Confidentiality
- Low
- Integrity
- Low
- Availability
- Low
Exploit likelihood
What each source reports
CVE List Score used
HTTP Request Smuggling
This affects all versions before 10.1.14 and from 10.2.0 to 10.2.4 of package com.typesafe.akka:akka-http-core. It allows multiple Transfer-Encoding headers.
- Record
CVE-2021-23339- CVSS 3.1
- 5.0 Medium
CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:L/I:L/A:L - Updated
- 2026-11-02
EUVDEUVD-2021-0909
This affects all versions before 10.1.14 and from 10.2.0 to 10.2.4 of package com.typesafe.akka:akka-http-core. It allows multiple Transfer-Encoding headers.
- Record
EUVD-2021-0909- CVSS 3.1
- 5.0 Medium
CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:L/I:L/A:L - Updated
- 2026-11-03
GitHub AdvisoriesGHSA-2w7w-2j92-44hx
HTTP Request Smuggling in akka-http-core
A vulnerable Akka HTTP server will accept a malformed message and hand it over to the user. If the user application proxies this message to another server unchanged and that server also accepts that message but interprets it as two HTTP messages, the second message has reached the second server without having been inspected by the proxy.
- Record
GHSA-2w7w-2j92-44hx- CVSS 3.1
- 6.5 Medium
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N - Weakness
- CWE-444
- Updated
- 2026-11-02
NVD
This affects all versions before 10.1.14 and from 10.2.0 to 10.2.4 of package com.typesafe.akka:akka-http-core. It allows multiple Transfer-Encoding headers.
- Record
CVE-2021-23339- CVSS 3.1
- 5.0 Medium
CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:L/I:L/A:L - CVSS 3.1
- 6.5 Medium
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N - CVSS 2.0
- 6.4 Medium
AV:N/AC:L/Au:N/C:P/I:P/A:N - Weakness
- CWE-444
- Updated
- 2026-11-02
OSV
This affects all versions before 10.1.14 and from 10.2.0 to 10.2.4 of package com.typesafe.akka:akka-http-core. It allows multiple Transfer-Encoding headers.
- Record
CVE-2021-23339- CVSS 3.1
- 6.5 Medium
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N - Updated
- 2026-11-02
OSVGHSA-2w7w-2j92-44hx
HTTP Request Smuggling in akka-http-core
A vulnerable Akka HTTP server will accept a malformed message and hand it over to the user. If the user application proxies this message to another server unchanged and that server also accepts that message but interprets it as two HTTP messages, the second message has reached the second server without having been inspected by the proxy.
- Record
GHSA-2w7w-2j92-44hx- CVSS 3.1
- 6.5 Medium
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N - Weakness
- CWE-444
- Updated
- 2026-11-02
Affected products
Affected packages
| Package | Affected | Fixed |
|---|---|---|
com.typesafe.akka:akka-http-coreMaven |
10.2.0 up to 10.2.4 | 10.2.4 |
com.typesafe.akka:akka-http-coreMaven |
before 10.1.14 | 10.1.14 |
com.typesafe.akka:akka-http-coreMaven |
before 10.1.14, plus listed versions 3.0.0-RC1 |
10.1.14 |
History
| Recorded | Changed | Sources |
|---|---|---|
| aliases, published | EUVD | |
| first indexed | CVE List, GitHub Advisories, NVD, OSV |
Dates are when Every CVE recorded each change. Upstream dates may differ.
In short
CVE-2021-23339 is a medium vulnerability (CVSS 5.0) in Lightbend Akka-http, published February 17, 2021. No source lists public exploit code. EPSS puts the chance of exploitation in the next 30 days at 0.71%, the 53rd percentile. Fixed in com.typesafe.akka:akka-http-core 10.2.4.
References
snyk.io/vuln/SNYK-JAVA-COMTYPESAFEAKKA-1075043
github.com/akka/akka-http/pull/3754%23issuecomment-779265201
nvd.nist.gov/vuln/detail/CVE-2021-23339
doc.akka.io/docs/akka-http/10.1/security/2021-02-24-incorrect-handling-of-Transfer-Encoding-header.html