The decodeRequest and decodeRequestWith directives in Lightbend Akka HTTP 10.1.x through 10.1.4 and 10.0.x through 10.0.13 allow remote attackers to cause a denial of service (memory consumption and daemon crash) via a ZIP bomb.
| Package (Ecosystem) | Introduced | Fixed | Limit |
|---|---|---|---|
| com.typesafe.akka:akka-http-core_2.12(Maven) | 10.1.0 | 10.1.4 | N/A |
| com.typesafe.akka:akka-http-core_2.11(Maven) | 10.1.0 | 10.1.4 | N/A |
CVSS Metrics
