Micronaut HTTP Client Vulnerability Under Investigation
An early warning has been issued regarding a potential vulnerability in the Micronaut HTTP Client, which reportedly does not impose a limit on HTTP redirections. This could enable an infinite redirect loop, potentially leading to a denial-of-service attack.
What happened
According to the advisory GHSA-387m-935m-c4vw, the Micronaut HTTP Client appears to be vulnerable due to the absence of a maximum redirect count. This could allow an attacker to create an infinite redirect loop, leading to a denial-of-service condition. The vulnerability is under investigation and has been classified as a critical CVE.
Affected components include micronaut (maven) versions prior to 5.0.1, 4.10.24, or 3.10.7. It is recommended to upgrade to Micronaut 5.0.1 or later, Micronaut 4.10.24 or later, or Micronaut 3.10.7 or later to mitigate this risk.
Professional software engineers using Micronaut should assess their exposure by checking their current version against the affected ranges. For more detailed information, consult the primary sources linked in the advisory.
How 0Day mitigates this
micronaut is anywhere in your dependency tree, the engineers who own the affected repositories get a push alert the moment it is flagged — no manual audit to remember to run.Read how this differs from waiting on a scanner to catch a known advisory, or see the exact, read-only access 0Day needs to do this for an organization.