We announce the immediate availability of the second security patch for the experimental Akka HTTP that was part of the 2.4.x development series. It contains an important security fix for a vulnerability that affects all Akka HTTP applications that use the routing DSL. The vulnerability allows a remote attacker to crash an Akka HTTP server with a simple request so it is highly recommended to update to Akka HTTP 22.214.171.124 as soon as possible. See the security announcement for more details.
Please note that for the latest developments of Akka HTTP you should switch to track its 10.0.x series - we strongly suggest upgrading to that version since it is the stable and maintained version of Akka HTTP, while the 2.4.11 version will only be receiving critical security updates for a while.
We strongly suggest upgrading to Akka 10.0.6 or later. Akka 10.0.x is backwards binary compatible with previous 10.0.x releases and Akka 2.4.x. This means that the new JARs are a drop-in replacement for the old one (but not the other way around) as long as your build does not enable the inliner (Scala-only restriction). It should be noted that Scala 2.12.x is is not binary compatible with Scala 2.11.x.
This release only contains 2 additional commits over its predecessor to resolve the Accept header vulnerability.
One critical issue was closed since 126.96.36.199.
The complete list of closed issues can be found on the 188.8.131.52 milestone on github.
– The Akka Team