Akka is an actor-model framework and HTTP server library used for building distributed, concurrent systems, with its durable vulnerability signal centered on deserialization of untrusted data, authentication mechanisms, and memory-buffer handling in its core runtime and management components. Defenders should treat deserialization flaws and access-control issues in this framework as structural risks in any application that embeds Akka for remoting or clustering, since the framework's distributed nature amplifies the blast radius of such flaws; live severity, exploitation, and exposure counts are shown alongside this summary.
The number and severity of CVEs published that impact products developed by Akka over time
Signals from CVEs in this vendor scope (6 CVEs).
6 CVEs · Highest risk first
| CVE | Published | CVSS | Risk | KEV | Exploit |
|---|---|---|---|---|---|
CVE-2023-44487HIGH The HTTP/2 protocol allows a denial of service (server resource consumption) because request cancellation can reset many streams quickly, as exploited in the wild in August through | Oct 10, 2023 | 7.5 | 97 | YES | YES |
CVE-2021-42697HIGH Akka HTTP 10.1.x before 10.1.15 and 10.2.x before 10.2.7 can encounter stack exhaustion while parsing HTTP headers, which allows a remote attacker to conduct a Denial of Service at | Nov 2, 2021 | 7.5 | 56 | NO | YES |
CVE-2017-1000034HIGH Akka versions <=2.4.16 and 2.5-M1 are vulnerable to a java deserialization attack in its Remoting component resulting in remote code execution in the context of the ActorSystem. | Jul 17, 2017 | 8.1 | 25 | NO | NO |
CVE-2017-1000118HIGH Akka HTTP versions <= 10.0.5 Illegal Media Range in Accept Header Causes StackOverflowError Leading to Denial of Service | Oct 5, 2017 | 7.5 | 22 | NO | NO |
CVE-2025-53393MEDIUM In Akka through 2.10.6, akka-cluster-metrics uses Java serialization for cluster metrics. | Jun 28, 2025 | 6.0 | 19 | NO | NO |
CVE-2025-46548MEDIUM If you enable Basic Authentication in Pekko Management using the Java DSL, the authenticator may not be properly applied.
Users that rely on authentication instead of making sure | Jun 3, 2025 | 6.5 | 19 | NO | NO |
Signals from CVEs in this vendor scope (6 CVEs).
An overview of all social media posts that mention a CVE ID that affects a product developed by Akka.
Media articles that mention a CVE ID that affects a product developed by Akka — matched by CVE ID, not by vendor name.