CVE-2021-42697: Akka HTTP Server DOS Vulnerability

CVE-2021-42697 Overview

CVE-2021-42697 is a Denial of Service (DoS) vulnerability affecting Akka HTTP, a popular HTTP library for building RESTful services in Scala and Java. The vulnerability exists in the HTTP header parsing functionality, where maliciously crafted User-Agent headers containing deeply nested comments can trigger stack exhaustion, causing the server to crash.

Akka HTTP versions 10.1.x before 10.1.15 and 10.2.x before 10.2.7 are susceptible to this attack. The flaw stems from recursive parsing of HTTP header comments, which lacks proper depth limits. An unauthenticated remote attacker can exploit this vulnerability by sending specially crafted HTTP requests to vulnerable servers, resulting in service disruption without requiring any user interaction or authentication.

Critical Impact
Remote attackers can crash Akka HTTP servers by sending a single malicious HTTP request with a deeply nested User-Agent header, causing complete service unavailability.

Affected Products

Akka HTTP Server versions 10.1.x before 10.1.15
Akka HTTP Server versions 10.2.x before 10.2.7

Discovery Timeline

2021-11-02 - CVE-2021-42697 published to NVD
2021-11-02 - Akka releases security patch version 10.2.7
2021-11-22 - Akka releases security patch version 10.1.15
2024-11-21 - Last updated in NVD database

Technical Details for CVE-2021-42697

Vulnerability Analysis

This vulnerability is classified as CWE-674 (Uncontrolled Recursion), where the Akka HTTP header parsing implementation recursively processes nested comment structures without enforcing adequate recursion depth limits. When parsing HTTP headers such as User-Agent, the parser encounters parentheses which denote comments according to HTTP specifications. Each nested comment level triggers an additional stack frame during recursive processing.

The attack can be executed remotely over the network without requiring any privileges or user interaction. The impact is limited to availability, with no effect on confidentiality or integrity. The vulnerability has a high likelihood of exploitation, as indicated by its EPSS percentile placing it among the most likely to be exploited vulnerabilities.

Root Cause

The root cause lies in the recursive comment parsing logic within Akka HTTP's header parser. HTTP headers allow comments enclosed in parentheses, and these comments can be nested. The parser implementation uses recursive function calls to handle each nesting level without implementing a maximum depth check. When an attacker sends a User-Agent header with thousands of nested parentheses, the recursive calls consume stack space until the JVM stack is exhausted, throwing a StackOverflowError and crashing the server process.

Attack Vector

The attack is conducted over the network by sending an HTTP request containing a User-Agent header with deeply nested comment structures. Since HTTP headers are processed before any application logic, no authentication is required. A single malicious request is sufficient to crash the server.

The attacker crafts a User-Agent header with multiple levels of nested parentheses. For example, a header like User-Agent: Mozilla/5.0 ((((...thousands of nested parens...)))) would trigger recursive parsing. Each opening parenthesis causes the parser to recurse deeper, and with sufficient nesting depth (typically several thousand levels), the JVM stack is exhausted.

The attack has been publicly documented with a proof-of-concept available on Packet Storm, making exploitation straightforward for attackers.

Detection Methods for CVE-2021-42697

Indicators of Compromise

HTTP requests containing User-Agent headers with abnormally long values or excessive parentheses
Server crashes or restarts correlated with incoming HTTP traffic
StackOverflowError exceptions in JVM application logs
Sudden service unavailability without apparent infrastructure issues

Detection Strategies

Monitor web server logs for User-Agent headers exceeding normal length thresholds (e.g., > 8KB)
Implement regex-based detection for headers containing excessive nested parentheses patterns
Configure application performance monitoring to alert on StackOverflowError occurrences
Deploy Web Application Firewall (WAF) rules to block requests with malformed or suspiciously long headers

Monitoring Recommendations

Set up alerting for JVM crashes with stack overflow patterns in application logs
Monitor HTTP request header sizes at the load balancer or reverse proxy level
Track server availability metrics and correlate downtime with traffic anomalies
Implement logging of rejected or sanitized malformed HTTP headers

How to Mitigate CVE-2021-42697

Immediate Actions Required

Upgrade Akka HTTP 10.2.x installations to version 10.2.7 or later
Upgrade Akka HTTP 10.1.x installations to version 10.1.15 or later
If immediate patching is not possible, deploy WAF rules to filter requests with excessively long User-Agent headers
Consider implementing request header size limits at the reverse proxy or load balancer

Patch Information

Akka has released patched versions addressing this vulnerability. Users should upgrade to the following versions:

Akka HTTP 10.2.x: Upgrade to version 10.2.7 or later - See the Akka HTTP 10.2.7 Release Announcement for details
Akka HTTP 10.1.x: Upgrade to version 10.1.15 or later - See the Akka HTTP 10.1.15 Release Announcement for details

For complete technical details on the vulnerability and remediation, refer to the official Akka HTTP CVE-2021-42697 Documentation.

Workarounds

Deploy a reverse proxy (e.g., Nginx, HAProxy) in front of Akka HTTP servers with header size limits
Implement WAF rules to block requests containing User-Agent headers longer than 4096 bytes
Configure network-level rate limiting to reduce the impact of DoS attempts
Monitor and automatically restart crashed Akka HTTP instances while patching is in progress

bash

# Example Nginx configuration to limit header sizes
# Add to http or server block
large_client_header_buffers 4 8k;
client_header_buffer_size 1k;

# Block requests with excessively long User-Agent headers
if ($http_user_agent ~* "^.{4096,}$") {
    return 403;
}