Description

All versions of io.micronaut:micronaut-http-client before 1.2.11 and all versions from 1.3.0 before 1.3.2 are vulnerable to HTTP Request Header Injection due to not validating request headers passed to the client.

Remediation

References

https://github.com/micronaut-projects/micronaut-core/security/advisories/GHSA-694p-xrhg-x3wm

https://snyk.io/vuln/SNYK-JAVA-IOMICRONAUT-561342

https://github.com/micronaut-projects/micronaut-core/commit/9d1eff5c8df1d6cda1fe00ef046729b2a6abe7f1

Related Vulnerabilities

CVE-2022-23541 Vulnerability in npm package jsonwebtoken

CVE-2023-40572 Vulnerability in maven package org.xwiki.platform:xwiki-platform-oldcore

CVE-2014-4671 Vulnerability in npm package hapi

CVE-2022-37199 Vulnerability in maven package com.jflyfox:jflyfox_jfinal

CVE-2021-3766 Vulnerability in npm package objection

Severity

Critical

Classification

CWE-444 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Tags

Exploit Patch Third Party Advisory