-
CVSS Score
-Basic Information
CVE ID
-
GHSA ID
-
EPSS Score
-
CWE
-
Published
-
Updated
-
KEV Status
-
Technology
-
Technical Details
Vulnerability Intelligence
Miggo AI
Miggo AIMiggo AIMiggo AIRoot Cause AnalysisThe vulnerability stems from uncontrolled recursion during HTTP header comment parsing. The advisory explicitly mentions stack exhaustion from deeply nested comments, and the patch introduced 'max-comment-parsing-depth' configuration. The workaround suggests disabling modeled header parsing, implicating HeaderParser's comment handling. While exact code isn't available, Akka's architecture places header parsing logic in HeaderParser.scala, with recursive comment parsing being a common pattern in parser implementations. The CWE-674 classification further supports the recursion control failure hypothesis.
| Package Name | Ecosystem | Vulnerable Versions | First Patched Version |
|---|---|---|---|
| com.typesafe.akka:akka-http | maven | >= 10.1.0, <= 10.2.6 | 10.2.7 |
JavaJavaOngoing coverage of React2Shell