Akka - vulnerabilities (CVEs)

6 CVEs in 3 products, 0 in the last 30 days, newest from 2025-06-28.

Products

CVE-2025-53393 - CVSS 6 (medium), 2025-06-28: In Akka through 2.10.6, akka-cluster-metrics uses Java serialization for cluster metrics.
CVE-2025-46548 - CVSS 6.5 (medium), 2025-06-03: If you enable Basic Authentication in Pekko Management using the Java DSL, the authenticator may not be properly applied. Users that rely on authentication…
CVE-2023-44487 - CVSS 7.5 (high), 2023-10-10: The HTTP/2 protocol allows a denial of service (server resource consumption) because request cancellation can reset many streams quickly, as exploited in the…
CVE-2021-42697 - CVSS 7.5 (high), 2021-11-02: Akka HTTP 10.1.x before 10.1.15 and 10.2.x before 10.2.7 can encounter stack exhaustion while parsing HTTP headers, which allows a remote attacker to conduct…
CVE-2017-1000118 - CVSS 7.5 (high), 2017-10-05: Akka HTTP versions <= 10.0.5 Illegal Media Range in Accept Header Causes StackOverflowError Leading to Denial of Service
CVE-2017-1000034 - CVSS 8.1 (high), 2017-07-17: Akka versions <=2.4.16 and 2.5-M1 are vulnerable to a java deserialization attack in its Remoting component resulting in remote code execution in the context…