CVE-2023-31442

Severity: high (CVSS 7.5 v3.1)
Exploited in the wild: not listed in CISA KEV
EPSS: 0.6% probability of exploitation in the next 30 days
Public exploit or detection template: none known
Published: 2023-05-11 · updated 2026-06-17

Description

In Lightbend Akka before 2.8.1, the async-dns resolver (used by Discovery in DNS mode and transitively by Cluster Bootstrap) uses predictable DNS transaction IDs when resolving DNS records, making DNS resolution subject to poisoning by an attacker. If the application performing discovery does not validate (e.g., via TLS) the authenticity of the discovered service, this may result in exfiltration of application data (e.g., persistence events may be published to an unintended Kafka broker). If such validation is performed, then the poisoning constitutes a denial of access to the intended service. This affects Akka 2.5.14 through 2.8.0, and Akka Discovery through 2.8.0.

Affected products

Lightbend Akka Actor: from 2.5.14 before 2.8.1 — fixed in 2.8.1
Lightbend Akka Discovery: before 2.8.1 — fixed in 2.8.1

How to fix

Upgrade to a fixed version: Lightbend Akka Actor 2.8.1; Lightbend Akka Discovery 2.8.1. Check the vendor advisory for mitigations.

References

Get alerted when CVE-2023-31442 or the next vulnerability affects your stack