{"id":"CVE-2020-7611","aliases":["GHSA-694p-xrhg-x3wm","SNYK-JAVA-IOMICRONAUT-561342"],"url":"https://o3.security/vulnerability/CVE-2020-7611","summary":"Micronaut's HTTP client is vulnerable to HTTP Request Header Injection","details":"All versions of io.micronaut:micronaut-http-client before 1.2.11 and all versions from 1.3.0 before 1.3.2 are vulnerable to HTTP Request Header Injection due to not validating request headers passed to the client.","published":"2020-03-30T22:15:15.603Z","modified":"2026-08-07T19:48:31.542442Z","cvss":{"score":9.8,"severity":"CRITICAL","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H"},"epss":null,"cisaKev":null,"exploitsKnown":2,"affectedPackages":[{"ecosystem":"Maven","name":"io.micronaut:micronaut-http-client","fixedVersion":"1.2.11"},{"ecosystem":"Maven","name":"io.micronaut:micronaut-http-client","fixedVersion":"1.3.2"}],"fix":{"url":"https://github.com/micronaut-projects/micronaut-core/commit/9d1eff5c8df1d6cda1fe00ef046729b2a6abe7f1","label":"micronaut-projects/micronaut-core@9d1eff5"},"references":[{"type":"FIX","url":"https://github.com/micronaut-projects/micronaut-core/commit/9d1eff5c8df1d6cda1fe00ef046729b2a6abe7f1"},{"type":"FIX","url":"https://github.com/micronaut-projects/micronaut-core/security/advisories/GHSA-694p-xrhg-x3wm"},{"type":"EVIDENCE","url":"https://snyk.io/vuln/SNYK-JAVA-IOMICRONAUT-561342"}],"provenance":{"sources":["OSV.dev","FIRST.org (EPSS)"],"lastVerified":"2026-08-07T19:48:31.542442Z"}}