GHSA-387m-935m-c4vw: High severity maven/io.micronaut:micronaut-http-client vulnerability
The Netty-based Micronaut HTTP Client does not impose a limit on HTTP redirections, potentially allowing an infinite redirect loop that could lead to a denial-of-service attack.
Patches
The following versions are patched:
- For Micronaut 5, versions equal or greater than 5.0.1 >= - For Micronaut 4, versions equal or greater than 4.10.24 >= - For Micronaut 3, versions equal or greater than 3.10.7 >=
Workarounds No
Resources Micronaut 5 Patch: https://github.com/micronaut-projects/micronaut-core/commit/6e88a972718d6e1521c5b3bb7766451798dba4e3 Micronaut 4 Patch: https://github.com/micronaut-projects/micronaut-core/commit/f1dffffec8fb5e3b7e94ae907ce0be3831e499d4 Micronaut 3 Patch: https://github.com/micronaut-projects/micronaut-core/commit/c06a2715ca7f78321bc3ca05f41cca78cd351320
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
maven/io.micronaut:micronaut-http-clientto a version that resolves this vulnerability.Fixed in 5.0.1 - Upgrade
Upgrade
maven/io.micronaut:micronaut-http-clientto a version that resolves this vulnerability.Fixed in 4.10.24 - Upgrade
Upgrade
maven/io.micronaut:micronaut-http-clientto a version that resolves this vulnerability.Fixed in 3.10.7 - Upgrade
Upgrade
Micronaut 3to a version that resolves this vulnerability.Fixed in 3.10.7Patch c06a2715ca7f78321bc3ca05f41cca78cd351320 - Upgrade
Upgrade
Micronaut 4to a version that resolves this vulnerability.Fixed in 4.10.24Patch f1dffffec8fb5e3b7e94ae907ce0be3831e499d4 - Upgrade
Upgrade
Micronaut 5to a version that resolves this vulnerability.Fixed in 5.0.1Patch 6e88a972718d6e1521c5b3bb7766451798dba4e3
Event History
Frequently Asked Questions
What is the severity of GHSA-387m-935m-c4vw?
The severity of GHSA-387m-935m-c4vw is high with a CVSS score of 7.5.
How do I fix GHSA-387m-935m-c4vw?
To fix GHSA-387m-935m-c4vw, update the Micronaut HTTP Client to version 5.0.1 or greater.
What type of vulnerability is GHSA-387m-935m-c4vw?
GHSA-387m-935m-c4vw is a denial-of-service vulnerability due to unbounded HTTP redirections.
What can be exploited in GHSA-387m-935m-c4vw?
GHSA-387m-935m-c4vw can be exploited to create an infinite redirect loop in the Netty-based Micronaut HTTP Client.
Which software is affected by GHSA-387m-935m-c4vw?
GHSA-387m-935m-c4vw affects the Maven package io.micronaut:micronaut-http-client.