CVE-2021-42697
HIGHAkka HTTP 10.1.0-10.1.14 and 10.2.0-10.2.6 - Denial of Service via User-Agent Header with Nested Comments
Title source: llmExploitation Summary
EIP tracks 2 public exploits for CVE-2021-42697. PoCs published by cxosmo.
AI-analyzed exploit summary This exploit triggers a denial of service (DoS) in Akka HTTP by sending a request with a nested header comment payload exceeding the default header limit, causing a stack overflow. It includes a connectivity check followed by the malicious request.
Description
Akka HTTP 10.1.x before 10.1.15 and 10.2.x before 10.2.7 can encounter stack exhaustion while parsing HTTP headers, which allows a remote attacker to conduct a Denial of Service attack by sending a User-Agent header with deeply nested comments.
Exploits (2)
This exploit triggers a denial of service (DoS) in Akka HTTP by sending a request with a nested header comment payload exceeding the default header limit, causing a stack overflow. It includes a connectivity check followed by the malicious request.
This PoC demonstrates a Denial of Service (DoS) attack against Akka HTTP servers by sending a User-Agent header with deeply nested comments, triggering stack exhaustion. The script first checks target reachability and then sends the malicious payload.
References (5)
Scores
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H