{"id":"CVE-2021-42697","aliases":["EUVD-2022-2193","GHSA-3hw2-h67c-wq66"],"status":"published","title":"Uncontrolled Recursion in Akka HTTP","description":"Akka HTTP 10.1.x before 10.1.15 and 10.2.x before 10.2.7 can encounter stack exhaustion while parsing HTTP headers, which allows a remote attacker to conduct a Denial of Service attack by sending a User-Agent header with deeply nested comments.","severity":{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"high","assessor":"primary","from":"nvd"},"epss":{"day":"2026-11-10","score":0.36139,"percentile":0.98489,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":true,"fix_available":true},"cwes":["CWE-674","CWE-787"],"published":"2021-11-02T21:44:54Z","modified":"2026-10-24T10:30:16Z","exploits":[{"source":"exploitdb","id":"EDB-50892","title":"Akka HTTP 10.1.14 - Denial of Service","type":"remote","platform":"multiple","date":"2022-05-11","url":"https://www.exploit-db.com/exploits/50892"},{"source":"pocgithub","id":"cxosmo/CVE-2021-42697","title":"cxosmo/CVE-2021-42697","date":"2022-04-24","url":"https://github.com/cxosmo/CVE-2021-42697"}],"fixes":[{"ecosystem":"Maven","package":"com.typesafe.akka:akka-http-core_2.13.0-RC3","fixed_in":["10.1.15"],"sources":["ghsa"]},{"ecosystem":"Maven","package":"com.typesafe.akka:akka-http-core_2.13.0-RC2","fixed_in":["10.1.15"],"sources":["ghsa"]},{"ecosystem":"Maven","package":"com.typesafe.akka:akka-http-core_2.13.0-M5","fixed_in":["10.1.15"],"sources":["ghsa"]},{"ecosystem":"Maven","package":"com.typesafe.akka:aakka-http-core_2.13.0-M3","fixed_in":["10.1.15"],"sources":["ghsa"]},{"ecosystem":"Maven","package":"com.typesafe.akka:akka-http-core_2.13","fixed_in":["10.1.15","10.2.7"],"sources":["ghsa","osv"]},{"ecosystem":"Maven","package":"com.typesafe.akka:akka-http-core_2.12","fixed_in":["10.1.15","10.2.7"],"sources":["ghsa","osv"]},{"ecosystem":"Maven","package":"com.typesafe.akka:akka-http-core_2.11","fixed_in":["10.1.15"],"sources":["ghsa","osv"]}],"affected":[{"source":"ghsa","ecosystem":"Maven","package":"com.typesafe.akka:akka-http-core_2.13.0-RC3","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"10.1.0"},{"fixed":"10.1.15"}]}]},{"source":"ghsa","ecosystem":"Maven","package":"com.typesafe.akka:akka-http-core_2.13.0-RC2","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"10.1.0"},{"fixed":"10.1.15"}]}]},{"source":"ghsa","ecosystem":"Maven","package":"com.typesafe.akka:akka-http-core_2.13.0-M5","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"10.1.0"},{"fixed":"10.1.15"}]}]},{"source":"ghsa","ecosystem":"Maven","package":"com.typesafe.akka:aakka-http-core_2.13.0-M3","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"10.1.0"},{"fixed":"10.1.15"}]}]},{"source":"ghsa","ecosystem":"Maven","package":"com.typesafe.akka:akka-http-core_2.13","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"10.1.0"},{"fixed":"10.1.15"}]}]},{"source":"ghsa","ecosystem":"Maven","package":"com.typesafe.akka:akka-http-core_2.13","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"10.2.0-M1"},{"fixed":"10.2.7"}]}]},{"source":"ghsa","ecosystem":"Maven","package":"com.typesafe.akka:akka-http-core_2.12","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"10.1.0"},{"fixed":"10.1.15"}]}]},{"source":"ghsa","ecosystem":"Maven","package":"com.typesafe.akka:akka-http-core_2.12","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"10.2.0-M1"},{"fixed":"10.2.7"}]}]},{"source":"ghsa","ecosystem":"Maven","package":"com.typesafe.akka:akka-http-core_2.11","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"10.1.0"},{"fixed":"10.1.15"}]}]},{"source":"osv","ecosystem":"Maven","package":"com.typesafe.akka:akka-http-core_2.13.0-RC3","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"10.1.0"}]}],"versions":["10.1.8"]},{"source":"osv","ecosystem":"Maven","package":"com.typesafe.akka:akka-http-core_2.13.0-RC2","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"10.1.0"}]}],"versions":["10.1.8"]},{"source":"osv","ecosystem":"Maven","package":"com.typesafe.akka:akka-http-core_2.13.0-M5","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"10.1.0"}]}],"versions":["10.1.7","10.1.8"]},{"source":"osv","ecosystem":"Maven","package":"com.typesafe.akka:aakka-http-core_2.13.0-M3","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"10.1.0"}]}]},{"source":"osv","ecosystem":"Maven","package":"com.typesafe.akka:akka-http-core_2.13","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"10.1.0"},{"fixed":"10.1.15"}]}],"versions":["10.1.10","10.1.11","10.1.12","10.1.13","10.1.14","10.1.8","10.1.9"]},{"source":"osv","ecosystem":"Maven","package":"com.typesafe.akka:akka-http-core_2.13","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"10.2.0-M1"},{"fixed":"10.2.7"}]}],"versions":["10.2.0","10.2.0-M1","10.2.0-RC1","10.2.0-RC2","10.2.1","10.2.2","10.2.3","10.2.4","10.2.5","10.2.5-M1","10.2.5-M2","10.2.6"]},{"source":"osv","ecosystem":"Maven","package":"com.typesafe.akka:akka-http-core_2.12","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"10.1.0"},{"fixed":"10.1.15"}]}],"versions":["10.1.0","10.1.1","10.1.10","10.1.11","10.1.12","10.1.13","10.1.14","10.1.2","10.1.3","10.1.4","10.1.5","10.1.6","10.1.7","10.1.8","10.1.9"]},{"source":"osv","ecosystem":"Maven","package":"com.typesafe.akka:akka-http-core_2.12","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"10.2.0-M1"},{"fixed":"10.2.7"}]}],"versions":["10.2.0","10.2.0-M1","10.2.0-RC1","10.2.0-RC2","10.2.1","10.2.2","10.2.3","10.2.4","10.2.5","10.2.5-M1","10.2.5-M2","10.2.6"]},{"source":"osv","ecosystem":"Maven","package":"com.typesafe.akka:akka-http-core_2.11","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"10.1.0"},{"fixed":"10.1.15"}]}],"versions":["10.1.0","10.1.1","10.1.10","10.1.11","10.1.12","10.1.13","10.1.14","10.1.2","10.1.3","10.1.4","10.1.5","10.1.6","10.1.7","10.1.8","10.1.9"]}],"products":[{"vendor":"akka","product":"http_server"}],"references":[{"url":"https://akka.io/blog/","tags":["x_refsource_MISC","x_transferred","Vendor Advisory","advisory"]},{"url":"https://doc.akka.io/docs/akka-http/current/security/2021-CVE-2021-42697-stack-overflow-parsing-user-agent.html","tags":["x_refsource_MISC","x_transferred","Vendor Advisory","advisory","web"]},{"url":"https://akka.io/blog/news/2021/11/02/akka-http-10.2.7-released","tags":["x_refsource_MISC","x_transferred","Release Notes","Vendor Advisory","advisory","web"]},{"url":"https://akka.io/blog/news/2021/11/22/akka-http-10.1.15-released","tags":["x_refsource_MISC","x_transferred","Release Notes","Vendor Advisory","advisory","web"]},{"url":"http://packetstormsecurity.com/files/167018/Akka-HTTP-10.1.14-Denial-Of-Service.html","tags":["x_refsource_MISC","x_transferred","Exploit","Third Party Advisory","VDB Entry","evidence","web"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2021-42697","tags":["advisory"]},{"url":"https://github.com/akka/akka-http/pull/3924","tags":["web"]},{"url":"https://akka.io/blog","tags":["web"]},{"url":"https://github.com/advisories/GHSA-3hw2-h67c-wq66"},{"url":"https://github.com/akka/akka-http","tags":["package"]}],"sources":{"cve":[{"id":"CVE-2021-42697","description":"Akka HTTP 10.1.x before 10.1.15 and 10.2.x before 10.2.7 can encounter stack exhaustion while parsing HTTP headers, which allows a remote attacker to conduct a Denial of Service attack by sending a User-Agent header with deeply nested comments.","status":"published","published":"2021-11-02T21:44:54Z","modified":"2024-08-04T03:38:50.142Z","updated_at":"2026-11-02T14:32:58.739039Z"}],"euvd":[{"id":"EUVD-2022-2193","description":"Akka HTTP 10.1.x before 10.1.15 and 10.2.x before 10.2.7 can encounter stack exhaustion while parsing HTTP headers, which allows a remote attacker to conduct a Denial of Service attack by sending a User-Agent header with deeply nested comments.","status":"published","published":"2021-11-02T21:44:54Z","modified":"2024-08-04T03:38:50Z","updated_at":"2026-11-03T03:24:15.299027Z"}],"ghsa":[{"id":"GHSA-3hw2-h67c-wq66","title":"Uncontrolled Recursion in Akka HTTP","description":"Akka HTTP 10.1.x and 10.2.x before 10.2.7 can encounter stack exhaustion while parsing HTTP headers, which allows a remote attacker to conduct a Denial of Service attack by sending a User-Agent header with deeply nested comments.","status":"published","published":"2022-05-24T19:19:40Z","modified":"2025-09-30T17:57:31Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"high"}],"cwes":["CWE-674","CWE-787"],"updated_at":"2026-11-02T14:38:59.83883Z"}],"nvd":[{"id":"CVE-2021-42697","description":"Akka HTTP 10.1.x before 10.1.15 and 10.2.x before 10.2.7 can encounter stack exhaustion while parsing HTTP headers, which allows a remote attacker to conduct a Denial of Service attack by sending a User-Agent header with deeply nested comments.","status":"published","published":"2021-11-02T22:15:08.957Z","modified":"2026-06-17T04:09:58.213Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"high","assessor":"primary"},{"version":"2.0","score":5,"vector":"AV:N/AC:L/Au:N/C:N/I:N/A:P","level":"medium","assessor":"primary"}],"cwes":["CWE-674"],"updated_at":"2026-11-02T14:07:00.549994Z"}],"osv":[{"id":"CVE-2021-42697","description":"Akka HTTP 10.1.x before 10.1.15 and 10.2.x before 10.2.7 can encounter stack exhaustion while parsing HTTP headers, which allows a remote attacker to conduct a Denial of Service attack by sending a User-Agent header with deeply nested comments.","status":"published","published":"2021-11-02T22:15:08.957Z","modified":"2026-10-24T10:30:16.106179602Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"high"}],"updated_at":"2026-11-02T15:44:21.557945Z"},{"id":"GHSA-3hw2-h67c-wq66","title":"Uncontrolled Recursion in Akka HTTP","description":"Akka HTTP 10.1.x and 10.2.x before 10.2.7 can encounter stack exhaustion while parsing HTTP headers, which allows a remote attacker to conduct a Denial of Service attack by sending a User-Agent header with deeply nested comments.","status":"published","published":"2022-05-24T19:19:40Z","modified":"2025-09-30T18:16:55.386086Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"high"}],"cwes":["CWE-674","CWE-787"],"updated_at":"2026-11-02T15:46:35.747385Z"}]}}