CVE-2020-7611 Micronaut's HTTP client is vulnerable to HTTP Request Header Injection

What is CVE-2020-7611?

CVE-2020-7611 is a critical vulnerability in io.micronaut:micronaut-http-client, published on 30 Mar 2020. An attacker can exploit it over the internet without logging in, with no action from the victim.

Official description

All versions of io.micronaut:micronaut-http-client before 1.2.11 and all versions from 1.3.0 before 1.3.2 are vulnerable to HTTP Request Header Injection due to not validating request headers passed to the client.

Weakness: CWE-444

Which versions are affected by CVE-2020-7611?

4 open source packages ship an affected version, including io.micronaut:micronaut-http-client. It affects 1 product.

Products include Objectcomputing Micronaut.

How do I fix CVE-2020-7611?

Upgrade io.micronaut:micronaut-http-client to a fixed version for your release line: 1.2.11 or 1.3.2.

Is CVE-2020-7611 being exploited?

There is no known exploitation of CVE-2020-7611 in the wild and no public exploit code.

Other vulnerabilities in io.micronaut:micronaut-http-client

• CVE-2026-33013 Micronaut vulnerable to DoS via crafted form-urlencoded body binding with descending array indices High 8.2
• CVE-2026-33012 Micronaut Framework vulnerable to a Denial of Service in HTML error response caching High 7.5
• CVE-2021-32769 Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') in micronaut-core High 7.5
• CVE-2022-21700 Memory leak in micronaut-core Medium 5.3
• CVE-2024-23639 micronaut-core management endpoints vulnerable to drive-by localhost attack Medium 5.1

Sources

• CVE record
• NVD
• OSV
• GitHub advisory
• How this page is made

Also known as GHSA-694p-xrhg-x3wm, SNYK-JAVA-IOMICRONAUT-561342.