{"vulnerability": "GHSA-387m-935m-c4vw", "sightings": [{"uuid": "9ad03b7b-c764-46c1-a34f-a602f848cffb", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "GHSA-387M-935M-C4VW", "type": "seen", "source": "https://gist.github.com/alon710/4972c27e69247db8e70c7471b199efc4", "content": "# GHSA-387M-935M-C4VW: GHSA-387m-935m-c4vw: Unbounded HTTP Redirections Enable Infinite Loop Denial of Service in Micronaut HTTP Client\n\n> **CVSS Score:** 7.5\n> **Published:** 2026-07-09\n> **Full Report:** https://cvereports.com/reports/GHSA-387M-935M-C4VW\n\n## Summary\nThe Netty-based HTTP Client in the Micronaut framework fails to enforce a maximum redirect ceiling by default when processing HTTP responses. This permits remote, attacker-controlled servers to trigger continuous, infinite redirect loops. The resulting recursion causes high CPU utilization, thread starvation, and potential memory exhaustion, inducing a Denial of Service (DoS) state in client-side applications.\n\n## TL;DR\nA missing ceiling on HTTP redirections in Micronaut's Netty HTTP Client allows a remote server to trap the client in an infinite loop, causing severe Denial of Service through thread and resource starvation.\n\n## Exploit Status: POC\n\n## Technical Details\n\n- **CWE ID**: CWE-835\n- **Attack Vector**: Network\n- **CVSS v3.1**: 7.5\n- **Impact**: Denial of Service (Availability: High)\n- **Exploit Status**: PoC Available\n- **KEV Status**: Not Listed\n\n## Affected Systems\n\n- io.micronaut:micronaut-http-client\n- Micronaut Framework HTTP Client\n- Netty-based Micronaut HTTP Client\n- **micronaut-http-client**: < 3.10.7 (Fixed in: `3.10.7`)\n- **micronaut-http-client**: >= 4.0.0-M1, < 4.10.24 (Fixed in: `4.10.24`)\n- **micronaut-http-client**: >= 5.0.0-M1, < 5.0.1 (Fixed in: `5.0.1`)\n\n## Mitigation\n\n- Upgrade the Micronaut platform or HTTP Client library to the recommended fixed versions.\n- Disable the automatic redirect-following option globally in application configurations.\n- Implement programmatically bounded, manual redirection logic to validate target domains before requesting them.\n- Configure strict egress firewalls to restrict the destinations that HTTP client services can access.\n\n**Remediation Steps:**\n1. Open the build configuration file (pom.xml or build.gradle) of the target project.\n2. Find the dependencies importing io.micronaut:micronaut-http-client or the Micronaut platform BOM.\n3. Update the version reference to 3.10.7+, 4.10.24+, or 5.0.1+ based on your active major version.\n4. If patching is delayed, open the application configuration file (application.yml) and add 'micronaut.http.client.follow-redirects: false'.\n5. Run integration tests containing the redirect-following logic to confirm that loops are terminated or skipped.\n\n## References\n\n- [GitHub Advisory Database Entry](https://github.com/advisories/GHSA-387M-935M-C4VW)\n- [Micronaut Core GitHub Advisory](https://github.com/micronaut-projects/micronaut-core/security/advisories/GHSA-387m-935m-c4vw)\n- [Micronaut Core Repository Source](https://github.com/micronaut-projects/micronaut-core)\n\n\n---\n*Generated by [CVEReports](https://cvereports.com/reports/GHSA-387M-935M-C4VW) - Automated Vulnerability Intelligence*", "creation_timestamp": "2026-07-09T17:11:45.198574Z"}]}