CVE-2018-16131: Vulnerability in com.typesafe.akka:akka-http-core_2.11 and com.typesafe.akka:akka-http-core_2.12
Summary
CVE-2018-16131: The decodeRequest and decodeRequestWith directives in Lightbend Akka HTTP 10.1.x through 10.1.4 and 10.0.x through 10.0.13 allow remote attackers to cause a denial of service (memory consumption and daemon crash) via a Z... Affects com.typesafe.akka:akka-http-core_2.12 versions >= 10.1.0, < 10.1.4. Fixed in 10.1.4. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
The com.typesafe.akka:akka-http-core_2.11 and com.typesafe.akka:akka-http-core_2.12 packages are part of the Lightbend Akka HTTP library. This library provides a toolkit for building HTTP-based applications using the Akka actor model. It offers various directives for handling HTTP requests and responses. However, a vulnerability has been discovered in the decodeRequest and decodeRequestWith directives in versions 10.1.x through 10.1.4 and 10.0.x through 10.0.13 of the library.
Vulnerability Detail
The vulnerability, identified as CVE-2018-16131, allows remote attackers to cause a denial of service (DoS) attack by exploiting the decodeRequest and decodeRequestWith directives. By sending a specially crafted request, an attacker can trigger a memory consumption issue and crash the daemon. This vulnerability can be exploited remotely, potentially leading to service disruption and system instability.
How To Fix
Latest published version: 10.5.3 as of 22 Oct 2026
Upgrading to it may include breaking changes; the version below is the minimum fixed release for this vulnerability.
If you need the minimum change
10.1.4
This is the first release that contains the fix.
Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
There is no known workaround for this vulnerability. It is essential to apply the recommended fix by updating to a non-vulnerable version of the library.
Conclusion
The com.typesafe.akka:akka-http-core_2.11 and com.typesafe.akka:akka-http-core_2.12 packages are vulnerable to a high severity DoS vulnerability (CVE-2018-16131). It is crucial to update to a fixed version (10.1.4 or above) to mitigate the risk of memory consumption and daemon crashes. For further support on vulnerability remediation, please contact DevNack.com.
See every vulnerability recorded for com.typesafe.akka:akka-http-core_2.12 →
FAQ
The vulnerability allows remote attackers to cause a DoS attack, leading to memory consumption and daemon crashes. This can result in service disruption and system instability.
You can use Vulert's playground (https://vulert.com/scanner) to check if your application is affected by this vulnerability. Vulert monitors and alerts in real-time for open-source vulnerabilities using just the pom.xml file.
The vulnerability affects versions 10.1.x through 10.1.4 and 10.0.x through 10.0.13 of the com.typesafe.akka:akka-http-core library.
Yes, the vulnerability has been fixed in versions 10.1.4 and above of the com.typesafe.akka:akka-http-core library. It is recommended to update to the latest non-vulnerable version.
No, there is no known workaround for this vulnerability. Updating to a fixed version is the only recommended solution.
References
Related vulnerabilities
Recent vulnerabilities recorded for com.typesafe.akka:akka-http-core_2.12.
