CVE-2021-23339
HTTP Request Smuggling in akka-http-core
6.5
MEDIUM
CVSS 3.1
EPSS 0.21%
Description
A vulnerable Akka HTTP server will accept a malformed message and hand it over to the user. If the user application proxies this message to another server unchanged and that server also accepts that message but interprets it as two HTTP messages, the second message has reached the second server without having been inspected by the proxy.
How to fix CVE-2021-23339
To remediate CVE-2021-23339, upgrade the affected package to a fixed version below.
- —upgrade to 10.2.4 or later
Is CVE-2021-23339 being exploited?
Low — EPSS is 0.2%, meaning exploitation activity has not been observed at scale.
Affected packages (1)
- >= 10.2.0, < 10.2.4
CVSS scores
| Source | Version | Severity | Vector |
|---|---|---|---|
| osv | CVSS 3.1 | MEDIUM6.5 | CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N |