CVE-2018-16131
First published: Thu Aug 30 2018(Updated: )
The decodeRequest and decodeRequestWith directives in Lightbend Akka HTTP 10.1.x through 10.1.4 and 10.0.x through 10.0.13 allow remote attackers to cause a denial of service (memory consumption and daemon crash) via a ZIP bomb.
Credit: cve@mitre.org
| Affected Software | Affected Version | How to fix |
|---|---|---|
| Lightbend Akka HTTP | >=10.0.0<=10.0.13 | |
| Lightbend Akka HTTP | >=10.1.0<=10.1.4 |
Never miss a vulnerability like this again
Sign up to SecAlerts for real-time vulnerability data matched to your software, aggregated from hundreds of sources.
Reference Links
- https://akka.io/blog/news/2018/08/30/akka-http-dos-vulnerability-found
- https://doc.akka.io/docs/akka-http/current/security/2018-09-05-denial-of-service-via-decodeRequest.html
- https://github.com/akka/akka-http/issues/2137
- https://groups.google.com/forum/#!topic/akka-security/Dj7INsYWdjg
- https://groups.google.com/forum/#%21topic/akka-security/Dj7INsYWdjg
Frequently Asked Questions
What is CVE-2018-16131?
CVE-2018-16131 is a vulnerability in Lightbend Akka HTTP that allows remote attackers to cause a denial of service by consuming excessive memory and crashing the daemon.
How does the CVE-2018-16131 vulnerability work?
The vulnerability is caused by the decodeRequest and decodeRequestWith directives in Lightbend Akka HTTP, which can be exploited by sending a ZIP bomb that consumes excessive memory and crashes the daemon.
Which versions of Lightbend Akka HTTP are affected by CVE-2018-16131?
Lightbend Akka HTTP versions 10.0.0 through 10.0.13 and 10.1.0 through 10.1.4 are affected by CVE-2018-16131.
What is the severity of CVE-2018-16131?
The severity of CVE-2018-16131 is high with a severity value of 7.5.
How can I mitigate the CVE-2018-16131 vulnerability?
To mitigate the vulnerability, upgrade to Lightbend Akka HTTP version 10.0.14 or 10.1.5 or later.
- collector/nvd-index
- agent/severity
- agent/references
- agent/weakness
- agent/author
- agent/type
- agent/description
- agent/event
- agent/first-publish-date
- agent/softwarecombine
- agent/last-modified-date
- agent/remedy
- agent/tags
- collector/mitre-cve
- source/MITRE
- vendor/lightbend
- canonical/lightbend akka http
- version/lightbend akka http/10.0.0
- version/lightbend akka http/10.0.13
- version/lightbend akka http/10.1.0
- version/lightbend akka http/10.1.4