CVE-2021-42697

HighCVSS 7.5/10Last modified Jun 17, 2026

Description

Akka HTTP 10.1.x before 10.1.15 and 10.2.x before 10.2.7 can encounter stack exhaustion while parsing HTTP headers, which allows a remote attacker to conduct a Denial of Service attack by sending a User-Agent header with deeply nested comments.

Metrics

CVSS 3.1 7.5/10CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

Weakness enumeration

CWE-674

Affected software

Vendor	Product	Versions
n/a	n/a	n/a

References

http://packetstormsecurity.com/files/167018/Akka-HTTP-10.1.14-Denial-Of-Service.htmlExploit, Third Party Advisory, VDB Entry
https://akka.io/blog/Vendor Advisory
https://akka.io/blog/news/2021/11/02/akka-http-10.2.7-releasedRelease Notes, Vendor Advisory
https://akka.io/blog/news/2021/11/22/akka-http-10.1.15-releasedRelease Notes, Vendor Advisory
https://doc.akka.io/docs/akka-http/current/security/2021-CVE-2021-42697-stack-overflow-parsing-user-agent.htmlVendor Advisory
http://packetstormsecurity.com/files/167018/Akka-HTTP-10.1.14-Denial-Of-Service.htmlExploit, Third Party Advisory, VDB Entry
https://akka.io/blog/Vendor Advisory
https://akka.io/blog/news/2021/11/02/akka-http-10.2.7-releasedRelease Notes, Vendor Advisory
https://akka.io/blog/news/2021/11/22/akka-http-10.1.15-releasedRelease Notes, Vendor Advisory
https://doc.akka.io/docs/akka-http/current/security/2021-CVE-2021-42697-stack-overflow-parsing-user-agent.htmlVendor Advisory

Timeline

Published: Nov 2, 2021
Last modified: Jun 17, 2026
NVD status: Modified

Related CVEs from 2021

CVE-2021-426987.8Project files are stored memory objects in the form of binary serialized data that can later be read and deserialized again to instantiate t CVE-2021-426995.9The affected product is vulnerable to cookie information being transmitted as cleartext over HTTP. An attacker can capture network traffic, CVE-2021-42706.1A vulnerability was found in Imprint CMS. It has been classified as problematic. Affected is the function SearchForm of the file ImprintCMS/CVE-2021-427003.3Inkscape 0.91 is vulnerable to an out-of-bounds read, which may allow an attacker to have access to unauthorized information.CVE-2021-427016.3An attacker could prepare a specially crafted project file that, if opened, would attempt to connect to the cloud and trigger a man in the m CVE-2021-427023.3Inkscape version 0.91 can access an uninitialized pointer, which may allow an attacker to have access to unauthorized information.CVE-2021-427036.1This vulnerability could allow an attacker to send malicious Javascript code resulting in hijacking of the user’s cookie/session tokens, red CVE-2021-427047.8Inkscape version 0.91 is vulnerable to an out-of-bounds write, which may allow an attacker to arbitrary execute code.CVE-2021-427057.8PLC Editor Versions 1.3.8 and prior is vulnerable to a stack-based buffer overflow while processing project files, which may allow an attack CVE-2021-427067.8This vulnerability could allow an attacker to disclose information and execute arbitrary code on affected installations of WebAccess/MHI Des CVE-2021-427077.8PLC Editor Versions 1.3.8 and prior is vulnerable to an out-of-bounds write while processing project files, which may allow an attacker to e CVE-2021-42716.1A vulnerability was found in panicsteve w2wiki. It has been rated as problematic. Affected by this issue is the function toHTML of the file