{"id":"CVE-2021-23339","aliases":["EUVD-2021-0909","GHSA-2w7w-2j92-44hx","SNYK-JAVA-COMTYPESAFEAKKA-1075043"],"status":"published","title":"HTTP Request Smuggling","description":"This affects all versions before 10.1.14 and from 10.2.0 to 10.2.4 of package com.typesafe.akka:akka-http-core. It allows multiple Transfer-Encoding headers.","severity":{"version":"3.1","score":5,"vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:L/I:L/A:L","level":"medium","assessor":"cna","from":"cve"},"epss":{"day":"2026-11-11","score":0.00711,"percentile":0.53996,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":false,"fix_available":true},"cwes":["CWE-444"],"published":"2021-02-17T07:55:14Z","modified":"2026-10-24T10:30:29Z","fixes":[{"ecosystem":"Maven","package":"com.typesafe.akka:akka-http-core","fixed_in":["10.2.4","10.1.14"],"sources":["ghsa","osv"]}],"affected":[{"source":"ghsa","ecosystem":"Maven","package":"com.typesafe.akka:akka-http-core","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"10.2.0"},{"fixed":"10.2.4"}]}]},{"source":"ghsa","ecosystem":"Maven","package":"com.typesafe.akka:akka-http-core","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"10.1.14"}]}]},{"source":"osv","ecosystem":"Maven","package":"com.typesafe.akka:akka-http-core","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"10.2.0"},{"fixed":"10.2.4"}]}]},{"source":"osv","ecosystem":"Maven","package":"com.typesafe.akka:akka-http-core","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"10.1.14"}]}],"versions":["3.0.0-RC1"]}],"products":[{"vendor":"lightbend","product":"akka-http"}],"references":[{"url":"https://snyk.io/vuln/SNYK-JAVA-COMTYPESAFEAKKA-1075043","tags":["x_refsource_MISC","x_transferred","Broken Link","advisory","web"]},{"url":"https://github.com/akka/akka-http/pull/3754%23issuecomment-779265201","tags":["x_refsource_MISC","x_transferred","Broken Link","fix","web"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2021-23339","tags":["advisory"]},{"url":"https://github.com/akka/akka-http/commit/e3a4935151c91cee28e65e6b894dd50839ef9d34","tags":["web"]},{"url":"https://doc.akka.io/docs/akka-http/10.1/security/2021-02-24-incorrect-handling-of-Transfer-Encoding-header.html","tags":["web"]},{"url":"https://github.com/advisories/GHSA-2w7w-2j92-44hx"}],"sources":{"cve":[{"id":"CVE-2021-23339","title":"HTTP Request Smuggling","description":"This affects all versions before 10.1.14 and from 10.2.0 to 10.2.4 of package com.typesafe.akka:akka-http-core. It allows multiple Transfer-Encoding headers.","status":"published","published":"2021-02-17T07:55:14.049Z","modified":"2024-09-16T20:23:01.801Z","cvss":[{"version":"3.1","score":5,"vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:L/I:L/A:L","level":"medium","assessor":"cna"}],"updated_at":"2026-11-02T14:33:00.819444Z"}],"euvd":[{"id":"EUVD-2021-0909","description":"This affects all versions before 10.1.14 and from 10.2.0 to 10.2.4 of package com.typesafe.akka:akka-http-core. It allows multiple Transfer-Encoding headers.","status":"published","published":"2021-02-17T07:55:14Z","modified":"2024-09-16T20:23:01Z","cvss":[{"version":"3.1","score":5,"vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:L/I:L/A:L","level":"medium"}],"updated_at":"2026-11-03T00:55:14.02226Z"}],"ghsa":[{"id":"GHSA-2w7w-2j92-44hx","title":"HTTP Request Smuggling in akka-http-core","description":"A vulnerable Akka HTTP server will accept a malformed message and hand it over to the user. If the user application proxies this message to another server unchanged and that server also accepts that message but interprets it as two HTTP messages, the second message has reached the second server without having been inspected by the proxy.","status":"published","published":"2021-05-10T15:17:09Z","modified":"2023-02-21T19:02:18Z","cvss":[{"version":"3.1","score":6.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N","level":"medium"}],"cwes":["CWE-444"],"updated_at":"2026-11-02T14:36:45.67005Z"}],"nvd":[{"id":"CVE-2021-23339","description":"This affects all versions before 10.1.14 and from 10.2.0 to 10.2.4 of package com.typesafe.akka:akka-http-core. It allows multiple Transfer-Encoding headers.","status":"published","published":"2021-02-17T08:15:11.33Z","modified":"2026-06-17T03:38:35.053Z","cvss":[{"version":"3.1","score":5,"vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:L/I:L/A:L","level":"medium","assessor":"secondary"},{"version":"3.1","score":6.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N","level":"medium","assessor":"primary"},{"version":"2.0","score":6.4,"vector":"AV:N/AC:L/Au:N/C:P/I:P/A:N","level":"medium","assessor":"primary"}],"cwes":["CWE-444"],"updated_at":"2026-11-02T14:06:50.031227Z"}],"osv":[{"id":"CVE-2021-23339","description":"This affects all versions before 10.1.14 and from 10.2.0 to 10.2.4 of package com.typesafe.akka:akka-http-core. It allows multiple Transfer-Encoding headers.","status":"published","published":"2021-02-17T08:15:11.33Z","modified":"2026-10-24T10:30:29.258500031Z","cvss":[{"version":"3.1","score":6.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N","level":"medium"}],"updated_at":"2026-11-02T15:44:18.367807Z"},{"id":"GHSA-2w7w-2j92-44hx","title":"HTTP Request Smuggling in akka-http-core","description":"A vulnerable Akka HTTP server will accept a malformed message and hand it over to the user. If the user application proxies this message to another server unchanged and that server also accepts that message but interprets it as two HTTP messages, the second message has reached the second server without having been inspected by the proxy.","status":"published","published":"2021-05-10T15:17:09Z","modified":"2026-07-08T06:49:40.385170912Z","cvss":[{"version":"3.1","score":6.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N","level":"medium"}],"cwes":["CWE-444"],"updated_at":"2026-11-02T15:46:34.700741Z"}]}}