GHSA-387m-935m-c4vw Micronaut doesn't set a maximum redirect count for its HTTP Client, enabling infinite loop DoS
An attacker can cause a denial of service by triggering an infinite redirect loop in the Micronaut HTTP Client due to missing redirect limits.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- Available
What is GHSA-387m-935m-c4vw?
GHSA-387m-935m-c4vw is a denial of service vulnerability in io.micronaut:micronaut-http-client, published on 9 Jul 2026. An attacker can exploit it over the internet without logging in, with no action from the victim.
Official description
The Netty-based Micronaut HTTP Client does not impose a limit on HTTP redirections, potentially allowing an infinite redirect loop that could lead to a denial-of-service attack.
Patches
The following versions are patched:
- For Micronaut 5, versions equal or greater than 5.0.1 >=
- For Micronaut 4, versions equal or greater than 4.10.24 >=
- For Micronaut 3, versions equal or greater than 3.10.7 >=
Workarounds
No
Resources
Micronaut 5 Patch: https://github.com/micronaut-projects/micronaut-core/commit/6e88a972718d6e1521c5b3bb7766451798dba4e3 Micronaut 4 Patch: https://github.com/micronaut-projects/micronaut-core/commit/f1dffffec8fb5e3b7e94ae907ce0be3831e499d4 Micronaut 3 Patch: https://github.com/micronaut-projects/micronaut-core/commit/c06a2715ca7f78321bc3ca05f41cca78cd351320
Which versions are affected by GHSA-387m-935m-c4vw?
6 open source packages ship an affected version, including io.micronaut:micronaut-http-client.
| Package | Affected | Fixed in |
|---|---|---|
io.micronaut:micronaut-http-client Maven | All versions | 3.10.7 |
io.micronaut:micronaut-http-client Maven | All versions | 3.10.7 |
io.micronaut:micronaut-http-client Maven | From 4.0.0-M1 | 4.10.24 |
io.micronaut:micronaut-http-client Maven | From 4.0.0-M1 | 4.10.24 |
io.micronaut:micronaut-http-client Maven | From 5.0.0-M1 | 5.0.1 |
io.micronaut:micronaut-http-client Maven | From 5.0.0-M1 | 5.0.1 |
How do I fix GHSA-387m-935m-c4vw?
Upgrade io.micronaut:micronaut-http-client to a fixed version for your release line: 3.10.7, 4.10.24 or 5.0.1.
Upgrade, then put limits on request size, rate and nesting depth so one client cannot exhaust the service. More about Denial of service.
Is GHSA-387m-935m-c4vw being exploited?
There is no known exploitation of GHSA-387m-935m-c4vw in the wild and no public exploit code.