{
"id": "GHSA-9qgc-p27w-3hjg",
"aliases": [
"CVE-2018-16131"
],
"details": "The decodeRequest and decodeRequestWith directives in Lightbend Akka HTTP 10.1.x through 10.1.4 and 10.0.x through 10.0.13 allow remote attackers to cause a denial of service (memory consumption and daemon crash) via a ZIP bomb.",
"summary": "High severity vulnerability that affects com.typesafe.akka:akka-http-core_2.11 and com.typesafe.akka:akka-http-core_2.12",
"affected": [
{
"ranges": [
{
"type": "ECOSYSTEM",
"events": [
{
"introduced": "10.1.0"
},
{
"fixed": "10.1.4"
}
]
}
],
"package": {
"name": "com.typesafe.akka:akka-http-core_2.12",
"ecosystem": "Maven"
}
},
{
"ranges": [
{
"type": "ECOSYSTEM",
"events": [
{
"introduced": "10.1.0"
},
{
"fixed": "10.1.4"
}
]
}
],
"package": {
"name": "com.typesafe.akka:akka-http-core_2.11",
"ecosystem": "Maven"
}
}
],
"modified": "2021-09-08T20:46:55Z",
"severity": [
{
"type": "CVSS_V3",
"score": "CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H"
}
],
"published": "2018-10-22T20:37:07Z",
"references": [
{
"url": "https://nvd.nist.gov/vuln/detail/CVE-2018-16131",
"type": "ADVISORY"
},
{
"url": "https://github.com/akka/akka-http/issues/2137",
"type": "WEB"
},
{
"url": "https://akka.io/blog/news/2018/08/30/akka-http-dos-vulnerability-found",
"type": "WEB"
},
{
"url": "https://doc.akka.io/docs/akka-http/current/security/2018-09-05-denial-of-service-via-decodeRequest.html",
"type": "WEB"
},
{
"url": "https://github.com/advisories/GHSA-9qgc-p27w-3hjg",
"type": "ADVISORY"
},
{
"url": "https://groups.google.com/forum/#!topic/akka-security/Dj7INsYWdjg",
"type": "WEB"
}
],
"schema_version": "1.4.0",
"database_specific": {
"cwe_ids": [
"CWE-400"
],
"severity": "HIGH",
"github_reviewed": true,
"nvd_published_at": null,
"github_reviewed_at": "2020-06-16T21:29:22Z"
}
}