CVE-2017-1000118: Improper Restriction of Operations within the Bounds of a Memory Buffer in akka-http-core
Summary
CVE-2017-1000118: Improper Restriction of Operations within the Bounds of a Memory Buffer in akka-http-core. Affects com.typesafe.akka:akka-http-core_2.12 versions < 10.0.6. Fixed in 10.0.6. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Habilume
Habit tracker with a companion that grows with you
Complete habits, earn Lume Points, and watch your Lume grow as you stay consistent.
Background
The akka-http-core package is a component of the Akka HTTP library, which provides a toolkit for building HTTP-based applications. It is written in Scala and supports both the Maven and SBT build systems. Akka HTTP is widely used for developing scalable and high-performance web services.
Vulnerability Detail
The vulnerability identified as CVE-2017-1000118 affects Akka HTTP versions up to 10.0.5. It is caused by an improper restriction of operations within the bounds of a memory buffer. Specifically, when an illegal media range is included in the 'Accept' header of an HTTP request, it can trigger a StackOverflowError, leading to a denial of service (DoS) condition. This vulnerability has a CVSS score of 7.5, indicating a high severity level.
How To Fix
Latest published version: 10.5.3 as of 22 Oct 2026
Upgrading to it may include breaking changes; the version below is the minimum fixed release for this vulnerability.
If you need the minimum change
10.0.6
This is the first release that contains the fix.
Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
There is no known workaround for this vulnerability. It is essential to upgrade to the fixed version of Akka HTTP to mitigate the risk of a DoS attack.
Conclusion
The vulnerability in Akka HTTP versions up to 10.0.5, identified as CVE-2017-1000118, can lead to a denial of service (DoS) condition. It is crucial to upgrade to version 10.0.6 or later to mitigate the risk. For further assistance and support in vulnerability remediation, please contact DevNack.com.
See every vulnerability recorded for com.typesafe.akka:akka-http-core_2.12 →
FAQ
Akka HTTP is a library for building HTTP-based applications in Scala. It provides a high-performance toolkit for handling HTTP requests and responses.
The vulnerability can be exploited to cause a denial of service (DoS) condition by triggering a StackOverflowError. This can lead to service disruption and unavailability.
Akka HTTP versions up to 10.0.5 are affected by this vulnerability.
Yes, upgrading to Akka HTTP version 10.0.6 or later will fix this vulnerability.
No, there are no known workarounds. Upgrading to the fixed version is the recommended solution.
References
Related vulnerabilities
Recent vulnerabilities recorded for com.typesafe.akka:akka-http-core_2.12.
Habilume
Habit tracker with a companion that grows with you
Complete habits, earn Lume Points, and watch your Lume grow as you stay consistent.
