GHSA-387m-935m-c4vw
Suggest an improvement- Source
- https://github.com/advisories/GHSA-387m-935m-c4vw
- Import Source
- https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2026/07/GHSA-387m-935m-c4vw/GHSA-387m-935m-c4vw.json
- JSON Data
- https://api.test.osv.dev/v1/vulns/GHSA-387m-935m-c4vw
- Downstream
- Published
- 2026-07-09T13:36:49Z
- Modified
- 2026-07-17T21:12:11Z
- Severity
-
- 7.5 (High) CVSS_V3 - CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H CVSS Calculator
- Summary
- Micronaut doesn't set a maximum redirect count for its HTTP Client, enabling infinite loop DoS
- Details
-
The Netty-based Micronaut HTTP Client does not impose a limit on HTTP redirections, potentially allowing an infinite redirect loop that could lead to a denial-of-service attack.
Patches
The following versions are patched:
- For Micronaut 5, versions equal or greater than 5.0.1 >=
- For Micronaut 4, versions equal or greater than 4.10.24 >=
- For Micronaut 3, versions equal or greater than 3.10.7 >=
Workarounds
No
Resources
Micronaut 5 Patch: https://github.com/micronaut-projects/micronaut-core/commit/6e88a972718d6e1521c5b3bb7766451798dba4e3 Micronaut 4 Patch: https://github.com/micronaut-projects/micronaut-core/commit/f1dffffec8fb5e3b7e94ae907ce0be3831e499d4 Micronaut 3 Patch: https://github.com/micronaut-projects/micronaut-core/commit/c06a2715ca7f78321bc3ca05f41cca78cd351320
- Database specific
{ "cwe_ids": [], "github_reviewed": true, "github_reviewed_at": "2026-07-09T13:36:49Z", "nvd_published_at": null, "severity": "HIGH" }- References
-
- https://github.com/micronaut-projects/micronaut-core/security/advisories/GHSA-387m-935m-c4vw
- https://github.com/micronaut-projects/micronaut-core/commit/6e88a972718d6e1521c5b3bb7766451798dba4e3
- https://github.com/micronaut-projects/micronaut-core/commit/c06a2715ca7f78321bc3ca05f41cca78cd351320
- https://github.com/micronaut-projects/micronaut-core/commit/f1dffffec8fb5e3b7e94ae907ce0be3831e499d4
- https://github.com/micronaut-projects/micronaut-core
Affected packages
Maven
io.micronaut:micronaut-http-client
Package
- Name
- io.micronaut:micronaut-http-client
- View open source insights on deps.dev
- Purl
- pkg:maven/io.micronaut/micronaut-http-client
Affected ranges
- Type
- ECOSYSTEM
- Events
-
Introduced0 Unknown introduced version / All previous versions are affectedFixed3.10.7
Affected versions
1.*
1.0.0.RC3
1.0.0
1.0.1
1.0.2
1.0.3
1.0.4
1.0.5
1.1.0.M1
1.1.0.M2
1.1.0.RC1
1.1.0.RC2
1.1.0
1.1.1
1.1.2
1.1.3
1.1.4
1.2.0.RC1
1.2.0.RC2
1.2.0
1.2.1
1.2.2
1.2.3
1.2.4
1.2.5
1.2.6
1.2.7
1.2.8
1.2.9
1.2.10
1.2.11
1.3.0.M1
1.3.0.M2
1.3.0.RC1
1.3.0
1.3.1
1.3.2
1.3.3
1.3.4
1.3.5
1.3.6
1.3.7
2.*
2.0.0.M1
2.0.0.M2
2.0.0.M3
2.0.0.RC1
2.0.0.RC2
2.0.0
2.0.1
2.0.2
2.0.3
2.1.0
2.1.1
2.1.2
2.1.3
2.1.4
2.2.0
2.2.1
2.2.2
2.2.3
2.3.0
2.3.1
2.3.2
2.3.3
2.3.4
2.4.0
2.4.1
2.4.2
2.4.3
2.4.4
2.5.0
2.5.1
2.5.2
2.5.3
2.5.4
2.5.5
2.5.6
2.5.7
2.5.8
2.5.9
2.5.10
2.5.11
2.5.12
2.5.13
3.*
3.0.0-M1
3.0.0-M2
3.0.0-M3
3.0.0-M4
3.0.0-M5
3.0.0-RC1
3.0.0
3.0.1
3.0.2
3.0.3
3.1.0
3.1.1
3.1.2
3.1.3
3.1.4
3.2.0
3.2.1
3.2.2
3.2.3
3.2.4
3.2.5
3.2.6
3.2.7
3.3.0-M1
3.3.0
3.3.1
3.3.2
3.3.3
3.3.4
3.4.0
3.4.1
3.4.2
3.4.3
3.4.4
3.5.0
3.5.1
3.5.2
3.5.3
3.5.4
3.5.5
3.5.6
3.5.7
3.6.0
3.6.1
3.6.2
3.6.3
3.6.4
3.6.5
3.6.6
3.7.0
3.7.1
3.7.2
3.7.3
3.7.4
3.7.5
3.7.6
3.7.7
3.8.0
3.8.1
3.8.2
3.8.3
3.8.4
3.8.5
3.8.6
3.8.7
3.8.8
3.8.9
3.8.10
3.8.11
3.8.12
3.8.13
3.8.14
3.8.15
3.9.0
3.9.1
3.9.2
3.9.3
3.9.4
3.9.5
3.9.6
3.9.7
3.10.0
3.10.1
3.10.2
3.10.3
3.10.4
3.10.5
3.10.6
io.micronaut:micronaut-http-client
Package
- Name
- io.micronaut:micronaut-http-client
- View open source insights on deps.dev
- Purl
- pkg:maven/io.micronaut/micronaut-http-client
Affected versions
4.*
4.0.0-M1
4.0.0-M2
4.0.0-M3
4.0.0-M4
4.0.0-M5
4.0.0-M6
4.0.0-M7
4.0.0-RC1
4.0.0-RC2
4.0.0-RC3
4.0.0-RC4
4.0.0-RC5
4.0.0
4.0.1
4.0.2
4.0.3
4.0.4
4.0.5
4.0.6
4.0.7
4.1.0
4.1.1
4.1.2
4.1.3
4.1.4
4.1.5
4.1.6
4.1.7
4.1.8
4.1.9
4.1.10
4.1.11
4.1.12
4.2.0
4.2.1
4.2.2
4.2.3
4.2.4
4.3.0
4.3.1
4.3.2
4.3.3
4.3.4
4.3.5
4.3.6
4.3.7
4.3.8
4.3.9
4.3.10
4.3.11
4.3.12
4.3.13
4.3.14
4.3.15
4.3.16
4.3.17
4.4.0
4.4.1
4.4.2
4.4.3
4.4.4
4.4.5
4.4.6
4.4.7
4.4.8
4.4.9
4.4.10
4.5.0
4.5.1
4.5.2
4.5.3
4.5.4
4.6.0
4.6.1
4.6.2
4.6.3
4.6.4
4.6.5
4.6.6
4.6.7
4.6.8
4.7.0
4.7.1
4.7.2
4.7.3
4.7.4
4.7.5
4.7.6
4.7.7
4.7.8
4.7.9
4.7.10
4.7.11
4.7.12
4.7.13
4.7.14
4.7.15
4.7.16
4.7.17
4.7.18
4.7.19
4.7.20
4.7.21
4.7.22
4.7.23
4.7.24
4.7.25
4.7.26
4.7.27
4.8.0
4.8.1
4.8.2
4.8.3
4.8.4
4.8.5
4.8.6
4.8.7
4.8.8
4.8.9
4.8.10
4.8.11
4.8.12
4.8.13
4.8.14
4.8.15
4.8.16
4.8.17
4.8.18
4.8.19
4.9.0
4.9.1
4.9.2
4.9.3
4.9.4
4.9.5
4.9.6
4.9.7
4.9.8
4.9.9
4.9.10
4.9.11
4.9.12
4.10.0
4.10.1
4.10.2
4.10.3
4.10.4
4.10.5
4.10.6
4.10.7
4.10.8
4.10.9
4.10.10
4.10.11
4.10.12
4.10.13
4.10.14
4.10.15
4.10.16
4.10.17
4.10.18
4.10.19
4.10.20
4.10.21
4.10.22
4.10.23
io.micronaut:micronaut-http-client
Package
- Name
- io.micronaut:micronaut-http-client
- View open source insights on deps.dev
- Purl
- pkg:maven/io.micronaut/micronaut-http-client