CVE-2021-42697

Vulnerability

Akka HTTP versions 10.1.x before 10.1.15 and 10.2.x before 10.2.7 suffer from a stack exhaustion vulnerability during HTTP header parsing [4]. A remote attacker can trigger this by sending a specially crafted User-Agent header containing deeply nested comments, causing the parser to consume excessive stack space [4].

Exploitation

An attacker can exploit this vulnerability without authentication or any special network position, as the HTTP server will parse the header upon receiving the request. The attacker simply sends an HTTP request with a User-Agent header that has deeply nested comments (e.g., multiple levels of parentheses). No user interaction is required [4].

Impact

Successful exploitation leads to a denial of service (DoS) condition due to stack exhaustion, crashing the Akka HTTP server process. This can result in service unavailability for legitimate users [4].

Mitigation

The vulnerability is fixed in Akka HTTP versions 10.1.15 [3] and 10.2.7 [1]. Users should upgrade to these versions or later. No workarounds are documented. There is no known exploitation in the wild (unconfirmed, but not mentioned). Not listed on CISA KEV as of now.