CVE-2018-16131

HighCVSS 7.5/10Last modified Jun 17, 2026

Description

The decodeRequest and decodeRequestWith directives in Lightbend Akka HTTP 10.1.x through 10.1.4 and 10.0.x through 10.0.13 allow remote attackers to cause a denial of service (memory consumption and daemon crash) via a ZIP bomb.

Metrics

CVSS 3.0 7.5/10CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

Weakness enumeration

CWE-400

Affected software

No affected versions have been published.

Timeline

Published: Aug 30, 2018
Last modified: Jun 17, 2026
NVD status: Modified

Related CVEs from 2018

CVE-2018-161328.6The image rendering component (createGenericPreview) of the Open Whisper Signal app through 2.29.0 for iOS fails to check for unreasonably l CVE-2018-161335.3Cybrotech CyBroHttpServer 1.0.3 allows Directory Traversal via a ../ in the URI.CVE-2018-161346.1Cybrotech CyBroHttpServer 1.0.3 allows XSS via a URI.CVE-2018-161356.5The Opera Mini application 47.1.2249.129326 for Android allows remote attackers to spoof the Location Permission dialog via a crafted web si CVE-2018-161368.8An issue was discovered in the administrator interface in IPBRICK OS 6.3. The application doesn't check for Anti-CSRF tokens, allowing the s CVE-2018-161378.8An issue was discovered in the Web Management Console in IPBRICK OS 6.3. There are multiple SQL injections.CVE-2018-161384.8An issue was discovered in the administration page in IPBRICK OS 6.3. There are multiple XSS vulnerabilities.CVE-2018-161396.1Cross-site scripting (XSS) vulnerability in BIBLIOsoft BIBLIOpac 2008 allows remote attackers to inject arbitrary web script or HTML via the CVE-2018-16147.5IBM WebSphere Application Server 7.0, 8.0, 8.5, and 9.0 using malformed SAML responses from the SAML identity provider could allow a remote CVE-2018-161407.8A buffer underwrite vulnerability in get_line() (read.c) in fig2dev 3.2.7a allows an attacker to write prior to the beginning of the buffer CVE-2018-161416.5ThinkCMF X2.2.3 has an arbitrary file deletion vulnerability in do_avatar in \application\User\Controller\ProfileController.class.php via an CVE-2018-161426.1PHPOK 4.8.278 has a Reflected XSS vulnerability in framework/www/login_control.php via the _back parameter to the ok_f function.