CVE-2021-42697

Akka HTTP 10.1.x before 10.1.15 and 10.2.x before 10.2.7 can encounter stack exhaustion while parsing HTTP headers, which allows a remote attacker to conduct a Denial of Service attack by sending a User-Agent header with deeply nested comments.

• CWE-674

• http://packetstormsecurity.com/files/167018/Akka-HTTP-10.1.14-Denial-Of-Service.htmlExploit, Third Party Advisory, VDB Entry
• https://akka.io/blog/Vendor Advisory
• https://akka.io/blog/news/2021/11/02/akka-http-10.2.7-releasedRelease Notes, Vendor Advisory
• https://akka.io/blog/news/2021/11/22/akka-http-10.1.15-releasedRelease Notes, Vendor Advisory
• https://doc.akka.io/docs/akka-http/current/security/2021-CVE-2021-42697-stack-overflow-parsing-user-agent.htmlVendor Advisory
• http://packetstormsecurity.com/files/167018/Akka-HTTP-10.1.14-Denial-Of-Service.htmlExploit, Third Party Advisory, VDB Entry
• https://akka.io/blog/Vendor Advisory
• https://akka.io/blog/news/2021/11/02/akka-http-10.2.7-releasedRelease Notes, Vendor Advisory
• https://akka.io/blog/news/2021/11/22/akka-http-10.1.15-releasedRelease Notes, Vendor Advisory
• https://doc.akka.io/docs/akka-http/current/security/2021-CVE-2021-42697-stack-overflow-parsing-user-agent.htmlVendor Advisory

Published

Nov 2, 2021

Last Modified

Jun 17, 2026

Status

Modified

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2021-42686An Integer Overflow exists in Accops HyWorks Windows Client …8.8
• CVE-2021-42687A Buffer Overflow vulnerability exists in Accops HyWorks Win…8.8
• CVE-2021-42688An Integer Overflow vulnerability exists in Accops HyWorks W…8.8
• CVE-2021-4269A vulnerability has been found in SimpleRisk and classified …6.1
• CVE-2021-42692There is a stack-overflow vulnerability in tinytoml v0.4 tha…6.5
• CVE-2021-42694An issue was discovered in the character definitions of the …8.3
• CVE-2021-42698Project files are stored memory objects in the form of binar…7.8
• CVE-2021-42699The affected product is vulnerable to cookie information bei…5.9
• CVE-2021-4270A vulnerability was found in Imprint CMS. It has been classi…6.1
• CVE-2021-42700Inkscape 0.91 is vulnerable to an out-of-bounds read, which …3.3
• CVE-2021-42701An attacker could prepare a specially crafted project file t…6.3
• CVE-2021-42702Inkscape version 0.91 can access an uninitialized pointer, w…3.3