Micronaut doesn't set a maximum redirect count for its HTTP Client, enabling infinite loop DoS
The Netty-based Micronaut HTTP Client does not impose a limit on HTTP redirections, potentially allowing an infinite redirect loop that could lead to a denial-of-service attack.
Patches
The following versions are patched:
- For Micronaut 5, versions equal or greater than 5.0.1 >=
- For Micronaut 4, versions equal or greater than 4.10.24 >=
- For Micronaut 3, versions equal or greater than 3.10.7 >=
Workarounds
No
Resources
Micronaut 5 Patch: https://github.com/micronaut-projects/micronaut-core/commit/6e88a972718d6e1521c5b3bb7766451798dba4e3 Micronaut 4 Patch: https://github.com/micronaut-projects/micronaut-core/commit/f1dffffec8fb5e3b7e94ae907ce0be3831e499d4 Micronaut 3 Patch: https://github.com/micronaut-projects/micronaut-core/commit/c06a2715ca7f78321bc3ca05f41cca78cd351320
Affected software
Click a technology to see all vulnerabilities affecting it.
| Platform | Package | Vulnerable versions | Fixed in |
|---|---|---|---|
| Java / Kotlin (Maven) | io.micronaut:micronaut-http-client | < 3.10.7, >= 4.0.0-M1, < 4.10.24, >= 5.0.0-M1, < 5.0.1 | 3.10.7, 4.10.24, 5.0.1 |
References
- https://github.com/micronaut-projects/micronaut-core/security/advisories/GHSA-387m-935m-c4vw
- https://github.com/micronaut-projects/micronaut-core/commit/6e88a972718d6e1521c5b3bb7766451798dba4e3
- https://github.com/micronaut-projects/micronaut-core/commit/c06a2715ca7f78321bc3ca05f41cca78cd351320
- https://github.com/micronaut-projects/micronaut-core/commit/f1dffffec8fb5e3b7e94ae907ce0be3831e499d4
- https://github.com/micronaut-projects/micronaut-core
- CVSS vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H- Weakness (CWE)
-- Platform
- Java / Kotlin (Maven)
- Package
io.micronaut:micronaut-http-client- Disclosed
- 09.07.2026
- Updated
- 11.10.2026 13:20
Sources and licenses
OSV / GitHub Advisory Database - GHSA-387m-935m-c4vw - CC BY 4.0
Vulnerability history: io.micronaut:micronaut-http-client
All published vulnerabilities of this package (Java / Kotlin (Maven)), newest first. Shows whether this is a one-off slip or a package that needs watching.
- Total entries
- 3
- First → latest
- 03.2020 07.2026
- Without a fix
- 0
- Exploited in attacks
- 0
Severity breakdown
- Critical 1
- High 1
- Medium 1
Disclosures per year
- 2020: 1
- 2021: 0
- 2022: 0
- 2023: 0
- 2024: 0
- 2025: 0
- 2026: 2
-
Micronaut doesn't set a maximum redirect count for its HTTP Client, enabling infinite loop DoS this entry
Know which vulnerabilities affect your application
With the DockRay integration and software inventory enabled, DockRay checks reported component versions against known vulnerabilities and notifies you about confirmed matches. Coverage depends on the supported technology and available advisory data.