{
"id": "GHSA-387m-935m-c4vw",
"aliases": [],
"details": "The Netty-based Micronaut HTTP Client does not impose a limit on HTTP redirections, potentially allowing an infinite redirect loop that could lead to a denial-of-service attack.\n\n### Patches\n\nThe following versions are patched: \n\n- For Micronaut 5, versions equal or greater than [5.0.1](https://github.com/micronaut-projects/micronaut-core/releases/v5.0.1) >=\n- For Micronaut 4, versions equal or greater than [4.10.24](https://github.com/micronaut-projects/micronaut-core/releases/v4.10.24) >=\n- For Micronaut 3, versions equal or greater than [3.10.7](https://github.com/micronaut-projects/micronaut-core/releases/v3.10.7) >=\n\n### Workarounds\nNo\n\n### Resources\nMicronaut 5 Patch: https://github.com/micronaut-projects/micronaut-core/commit/6e88a972718d6e1521c5b3bb7766451798dba4e3\nMicronaut 4 Patch: https://github.com/micronaut-projects/micronaut-core/commit/f1dffffec8fb5e3b7e94ae907ce0be3831e499d4\nMicronaut 3 Patch: https://github.com/micronaut-projects/micronaut-core/commit/c06a2715ca7f78321bc3ca05f41cca78cd351320",
"summary": "Micronaut doesn't set a maximum redirect count for its HTTP Client, enabling infinite loop DoS",
"affected": [
{
"ranges": [
{
"type": "ECOSYSTEM",
"events": [
{
"introduced": "0"
},
{
"fixed": "3.10.7"
}
]
}
],
"package": {
"name": "io.micronaut:micronaut-http-client",
"ecosystem": "Maven"
}
},
{
"ranges": [
{
"type": "ECOSYSTEM",
"events": [
{
"introduced": "4.0.0-M1"
},
{
"fixed": "4.10.24"
}
]
}
],
"package": {
"name": "io.micronaut:micronaut-http-client",
"ecosystem": "Maven"
}
},
{
"ranges": [
{
"type": "ECOSYSTEM",
"events": [
{
"introduced": "5.0.0-M1"
},
{
"fixed": "5.0.1"
}
]
}
],
"package": {
"name": "io.micronaut:micronaut-http-client",
"ecosystem": "Maven"
}
}
],
"modified": "2026-07-09T13:36:49Z",
"severity": [
{
"type": "CVSS_V3",
"score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H"
}
],
"published": "2026-07-09T13:36:49Z",
"references": [
{
"url": "https://github.com/micronaut-projects/micronaut-core/security/advisories/GHSA-387m-935m-c4vw",
"type": "WEB"
},
{
"url": "https://github.com/micronaut-projects/micronaut-core/commit/6e88a972718d6e1521c5b3bb7766451798dba4e3",
"type": "WEB"
},
{
"url": "https://github.com/micronaut-projects/micronaut-core/commit/c06a2715ca7f78321bc3ca05f41cca78cd351320",
"type": "WEB"
},
{
"url": "https://github.com/micronaut-projects/micronaut-core/commit/f1dffffec8fb5e3b7e94ae907ce0be3831e499d4",
"type": "WEB"
},
{
"url": "https://github.com/micronaut-projects/micronaut-core",
"type": "PACKAGE"
}
],
"schema_version": "1.4.0",
"database_specific": {
"cwe_ids": [],
"severity": "HIGH",
"github_reviewed": true,
"nvd_published_at": null,
"github_reviewed_at": "2026-07-09T13:36:49Z"
}
}