{"id":"GHSA-387m-935m-c4vw","aliases":[],"url":"https://o3.security/vulnerability/GHSA-387m-935m-c4vw","summary":"Micronaut doesn't set a maximum redirect count for its HTTP Client, enabling infinite loop DoS","details":"The Netty-based Micronaut HTTP Client does not impose a limit on HTTP redirections, potentially allowing an infinite redirect loop that could lead to a denial-of-service attack.\n\n### Patches\n\nThe following versions are patched: \n\n- For Micronaut 5, versions equal or greater than [5.0.1](https://github.com/micronaut-projects/micronaut-core/releases/v5.0.1) >=\n- For Micronaut 4, versions equal or greater than [4.10.24](https://github.com/micronaut-projects/micronaut-core/releases/v4.10.24) >=\n- For Micronaut 3, versions equal or greater than [3.10.7](https://github.com/micronaut-projects/micronaut-core/releases/v3.10.7) >=\n\n### Workarounds\nNo\n\n### Resources\nMicronaut 5 Patch: https://github.com/micronaut-projects/micronaut-core/commit/6e88a972718d6e1521c5b3bb7766451798dba4e3\nMicronaut 4 Patch: https://github.com/micronaut-projects/micronaut-core/commit/f1dffffec8fb5e3b7e94ae907ce0be3831e499d4\nMicronaut 3 Patch: https://github.com/micronaut-projects/micronaut-core/commit/c06a2715ca7f78321bc3ca05f41cca78cd351320","published":"2026-07-09T13:36:49Z","modified":"2026-07-13T20:29:43.248209653Z","cvss":{"score":7.5,"severity":"HIGH","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H"},"epss":null,"cisaKev":null,"exploitsKnown":0,"affectedPackages":[{"ecosystem":"Maven","name":"io.micronaut:micronaut-http-client","fixedVersion":"3.10.7"},{"ecosystem":"Maven","name":"io.micronaut:micronaut-http-client","fixedVersion":"4.10.24"},{"ecosystem":"Maven","name":"io.micronaut:micronaut-http-client","fixedVersion":"5.0.1"}],"fix":{"url":"https://github.com/micronaut-projects/micronaut-core/commit/6e88a972718d6e1521c5b3bb7766451798dba4e3","label":"micronaut-projects/micronaut-core@6e88a97"},"references":[{"type":"WEB","url":"https://github.com/micronaut-projects/micronaut-core/security/advisories/GHSA-387m-935m-c4vw"},{"type":"WEB","url":"https://github.com/micronaut-projects/micronaut-core/commit/6e88a972718d6e1521c5b3bb7766451798dba4e3"},{"type":"WEB","url":"https://github.com/micronaut-projects/micronaut-core/commit/c06a2715ca7f78321bc3ca05f41cca78cd351320"},{"type":"WEB","url":"https://github.com/micronaut-projects/micronaut-core/commit/f1dffffec8fb5e3b7e94ae907ce0be3831e499d4"},{"type":"PACKAGE","url":"https://github.com/micronaut-projects/micronaut-core"}],"provenance":{"sources":["OSV.dev","FIRST.org (EPSS)"],"lastVerified":"2026-07-13T20:29:43.248209653Z"}}