CVE-2021-23339

Published: Feb 17, 2021Modified: Jun 17, 2026

6.5

Vector

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N

Exploitability: 3.9 / Impact: 2.5

Source: NVD

Description

This affects all versions before 10.1.14 and from 10.2.0 to 10.2.4 of package com.typesafe.akka:akka-http-core. It allows multiple Transfer-Encoding headers.

Affected (2)

Products: Lightbend: Akka Http

Lightbend

1 product

Akka Http

Configuration A

2 vulnerable

Vulnerable Software	Affected Versions
Lightbend Akka Http	Before 10.1.14
Lightbend Akka Http	From 10.2.0 to 10.2.4

Related CWEs

CWE-444

Inconsistent Interpretation of HTTP Requests ('HTTP Request/Response Smuggling')

The product acts as an intermediary HTTP agent (such as a proxy or firewall) in the data flow between two entities such as a client and server, but it does not interpret malformed HTTP requests or responses in ways that are consistent with how the messages will be processed by those entities that are at the ultimate destination.

References (4)

https://github.com/akka/akka-http/pull/3754%23issuecomment-779265201

Source: report@snyk.io

Broken Link

https://snyk.io/vuln/SNYK-JAVA-COMTYPESAFEAKKA-1075043

Source: report@snyk.io

Broken Link

https://github.com/akka/akka-http/pull/3754%23issuecomment-779265201

Source: af854a3a-2127-422b-91ae-364da2661108

Broken Link

https://snyk.io/vuln/SNYK-JAVA-COMTYPESAFEAKKA-1075043

Source: af854a3a-2127-422b-91ae-364da2661108

Broken Link

Timeline

No history available yet.