Lightbend's vulnerability footprint concentrates in a small portfolio of reactive and functional application frameworks, including Play Framework, Akka, and associated tooling, which serve as core components in event-driven and distributed systems development. Vulnerabilities affecting the vendor skew toward serious outcomes, with a meaningful share reaching critical severity; the recurring weakness classes—including uncontrolled resource consumption, recursion flaws, and CSRF—reflect the parsing complexity and state-management demands of framework-level software. Defenders should track Lightbend's releases when operating Play or Akka-based services; live severity and exploitation figures are shown alongside this summary.
The number and severity of CVEs published that impact products developed by Lightbend over time
Signals from CVEs in this vendor scope (19 CVEs).
19 CVEs · Highest risk first
| CVE | Published | CVSS | Risk | KEV | Exploit |
|---|---|---|---|---|---|
CVE-2014-3630CRITICAL XML external entity (XXE) vulnerability in the Java XML processing functionality in Play before 2.2.6 and 2.3.x before 2.3.5 might allow remote attackers to read arbitrary files, c | Dec 29, 2017 | 9.8 | 31 | NO | NO |
CVE-2018-16115CRITICAL Lightbend Akka 2.5.x before 2.5.16 allows message disclosure and modification because of an RNG error. A random number generator is used in Akka Remoting for TLS (both classic and | Aug 29, 2018 | 9.1 | 29 | NO | NO |
CVE-2018-16131HIGH The decodeRequest and decodeRequestWith directives in Lightbend Akka HTTP 10.1.x through 10.1.4 and 10.0.x through 10.0.13 allow remote attackers to cause a denial of service (memo | Aug 30, 2018 | 7.5 | 26 | NO | NO |
CVE-2018-18854HIGH Lightbend Spray spray-json through 1.3.4 allows remote attackers to cause a denial of service (resource consumption) because of Algorithmic Complexity during the parsing of many JS | Oct 31, 2018 | 7.5 | 25 | NO | NO |
CVE-2018-18853HIGH Lightbend Spray spray-json through 1.3.4 allows remote attackers to cause a denial of service (resource consumption) because of Algorithmic Complexity during the parsing of a field | Oct 31, 2018 | 7.5 | 25 | NO | NO |
CVE-2018-13864HIGH A directory traversal vulnerability has been found in the Assets controller in Play Framework 2.6.12 through 2.6.15 (fixed in 2.6.16) when running on Windows. It allows a remote at | Jul 17, 2018 | 7.5 | 25 | NO | NO |
CVE-2023-31442HIGH In Lightbend Akka before 2.8.1, the async-dns resolver (used by Discovery in DNS mode and transitively by Cluster Bootstrap) uses predictable DNS transaction IDs when resolving DNS | May 11, 2023 | 7.5 | 24 | NO | NO |
CVE-2022-31023HIGH Play Framework is a web framework for Java and Scala. Verions prior to 2.8.16 are vulnerable to generation of error messages containing sensitive information. Play Framework, when | Jun 2, 2022 | 7.5 | 24 | NO | NO |
CVE-2022-31018HIGH Play Framework is a web framework for Java and Scala. A denial of service vulnerability has been discovered in verions 2.8.3 through 2.8.15 of Play's forms library, in both the Sca | Jun 2, 2022 | 7.5 | 24 | NO | NO |
CVE-2020-27196HIGH An issue was discovered in PlayJava in Play Framework 2.6.0 through 2.8.2. The body parsing of HTTP requests eagerly parses a payload given a Content-Type header. A deep JSON struc | Nov 6, 2020 | 7.5 | 24 | NO | NO |
Signals from CVEs in this vendor scope (19 CVEs).
An overview of all social media posts that mention a CVE ID that affects a product developed by Lightbend.
Media articles that mention a CVE ID that affects a product developed by Lightbend — matched by CVE ID, not by vendor name.