CVE-2018-16131
High severity vulnerability that affects com.typesafe.akka:akka-http-core_2.11 and com.typesafe.akka:akka-http-core_2.12
CVE-2018-16131 is a high vulnerability (CVSS 7.5) in Lightbend Akka Http, published August 30, 2018. No source lists public exploit code. EPSS puts the chance of exploitation in the next 30 days at 3.05%, the 87th percentile. Fixed in com.typesafe.akka:akka-http-core_2.12 10.1.4.
- Severity
- 7.5 HighCVSS 3.0, NVD
- Exploit chance
- 3.05%EPSS, 87th percentile
- Exploitation
- None knownNot on CISA’s or ENISA’s lists
- Fixed in
10.1.4com.typesafe.akka:akka-http-core_2.12 +3 more
Description
The decodeRequest and decodeRequestWith directives in Lightbend Akka HTTP 10.1.x through 10.1.4 and 10.0.x through 10.0.13 allow remote attackers to cause a denial of service (memory consumption and daemon crash) via a ZIP bomb.
Attack profile
How easy it is to exploit
- Attack vector
- Network
- Complexity
- Low
- Privileges needed
- None
- User interaction
- None
What an attacker can affect
- Confidentiality
- None
- Integrity
- None
- Availability
- High
Exploit likelihood
Affected products
Affected packages
| Package | Affected | Fixed |
|---|---|---|
com.typesafe.akka:akka-http-core_2.12Maven | 10.1.0 up to 10.1.4 | 10.1.4 |
com.typesafe.akka:akka-http-core_2.11Maven | 10.1.0 up to 10.1.4 | 10.1.4 |
com.typesafe.akka:akka-http-core_2.12Maven | 10.1.0 up to 10.1.4, plus listed versions 10.1.110.1.210.1.3 | 10.1.4 |
com.typesafe.akka:akka-http-core_2.11Maven | 10.1.0 up to 10.1.4, plus listed versions 10.1.110.1.210.1.3 | 10.1.4 |
What each source reports
NVD Score used
The decodeRequest and decodeRequestWith directives in Lightbend Akka HTTP 10.1.x through 10.1.4 and 10.0.x through 10.0.13 allow remote attackers to cause a denial of service (memory consumption and daemon crash) via a ZIP bomb.
- Record
CVE-2018-16131- CVSS 3.0
- 7.5 High
CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H - CVSS 2.0
- 7.8 High
AV:N/AC:L/Au:N/C:N/I:N/A:C - Weakness
- CWE-400
- Updated
- 2026-11-02
CVE ListNo score
The decodeRequest and decodeRequestWith directives in Lightbend Akka HTTP 10.1.x through 10.1.4 and 10.0.x through 10.0.13 allow remote attackers to cause a denial of service (memory consumption and daemon crash) via a ZIP bomb.
- Record
CVE-2018-16131- Updated
- 2026-11-02
EUVDEUVD-2018-0565No score
The decodeRequest and decodeRequestWith directives in Lightbend Akka HTTP 10.1.x through 10.1.4 and 10.0.x through 10.0.13 allow remote attackers to cause a denial of service (memory consumption and daemon crash) via a ZIP bomb.
- Record
EUVD-2018-0565- Updated
- 2026-11-03
GitHub AdvisoriesGHSA-9qgc-p27w-3hjg
High severity vulnerability that affects com.typesafe.akka:akka-http-core_2.11 and com.typesafe.akka:akka-http-core_2.12
The decodeRequest and decodeRequestWith directives in Lightbend Akka HTTP 10.1.x through 10.1.4 and 10.0.x through 10.0.13 allow remote attackers to cause a denial of service (memory consumption and daemon crash) via a ZIP bomb.
- Record
GHSA-9qgc-p27w-3hjg- CVSS 3.0
- 7.5 High
CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H - Weakness
- CWE-400
- Updated
- 2026-11-02
OSV
The decodeRequest and decodeRequestWith directives in Lightbend Akka HTTP 10.1.x through 10.1.4 and 10.0.x through 10.0.13 allow remote attackers to cause a denial of service (memory consumption and daemon crash) via a ZIP bomb.
- Record
CVE-2018-16131- CVSS 3.0
- 7.5 High
CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H - Updated
- 2026-11-02
OSVGHSA-9qgc-p27w-3hjg
High severity vulnerability that affects com.typesafe.akka:akka-http-core_2.11 and com.typesafe.akka:akka-http-core_2.12
The decodeRequest and decodeRequestWith directives in Lightbend Akka HTTP 10.1.x through 10.1.4 and 10.0.x through 10.0.13 allow remote attackers to cause a denial of service (memory consumption and daemon crash) via a ZIP bomb.
- Record
GHSA-9qgc-p27w-3hjg- CVSS 3.0
- 7.5 High
CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H - Weakness
- CWE-400
- Updated
- 2026-11-02
History
| Recorded | Changed | Sources |
|---|---|---|
| facts | ||
| aliases | EUVD | |
| first indexed | CVE List, GitHub Advisories, NVD, OSV |
Dates are when Every CVE recorded each change. Upstream dates may differ.