io.micronaut:micronaut-http-client-core@4.10.16

latest version

5.1.12

latest non vulnerable version

5.1.12

first published

6 years ago

latest version published

4 days ago

licenses detected

Apache-2.0
[2.0.0.M1,)

package registry

View on Maven Central Repository

Go back to all versions of this package

Report a new vulnerability Found a mistake?

Direct Vulnerabilities

Known vulnerabilities in the io.micronaut:micronaut-http-client-core package. This does not include vulnerabilities belonging to this package’s dependencies.

Fix vulnerabilities automatically

Snyk's AI Trust Platform automatically finds the best upgrade path and integrates with your development workflows. Secure your code at zero cost.

Fix for free

Vulnerability Vulnerable Version

Vulnerability	Vulnerable Version
H Infinite loop Affected versions of this package are vulnerable to Infinite loop due to the lack of a maximum redirect count in the `process` handling HTTP redirections. An attacker can exhaust system resources and cause service disruption by triggering an infinite redirect loop. How to fix Infinite loop? Upgrade `io.micronaut:micronaut-http-client-core` to version 3.10.7, 4.10.24, 5.0.1 or higher.	[,3.10.7)[4.0.0-M1,4.10.24)[5.0.0-M1,5.0.1)
H Insufficiently Protected Credentials Affected versions of this package are vulnerable to Insufficiently Protected Credentials in the `DefaultHttpClient` process, which follows redirects and forwards sensitive headers such as `Authorization`, `Cookie`, and `Proxy-Authorization` to redirect targets across domain boundaries. An attacker can obtain confidential information by inducing a redirect to a domain they control, causing the client to forward these sensitive headers. How to fix Insufficiently Protected Credentials? Upgrade `io.micronaut:micronaut-http-client-core` to version 3.10.6, 4.10.24, 5.0.1 or higher.	[1.2.8,3.10.6)[4.0.0-M1,4.10.24)[5.0.0-M1,5.0.1)

Infinite loop

Affected versions of this package are vulnerable to Infinite loop due to the lack of a maximum redirect count in the process handling HTTP redirections. An attacker can exhaust system resources and cause service disruption by triggering an infinite redirect loop.

How to fix Infinite loop?

Upgrade io.micronaut:micronaut-http-client-core to version 3.10.7, 4.10.24, 5.0.1 or higher.

[,3.10.7)[4.0.0-M1,4.10.24)[5.0.0-M1,5.0.1)

Insufficiently Protected Credentials

Affected versions of this package are vulnerable to Insufficiently Protected Credentials in the DefaultHttpClient process, which follows redirects and forwards sensitive headers such as Authorization, Cookie, and Proxy-Authorization to redirect targets across domain boundaries. An attacker can obtain confidential information by inducing a redirect to a domain they control, causing the client to forward these sensitive headers.

How to fix Insufficiently Protected Credentials?

Upgrade io.micronaut:micronaut-http-client-core to version 3.10.6, 4.10.24, 5.0.1 or higher.

[1.2.8,3.10.6)[4.0.0-M1,4.10.24)[5.0.0-M1,5.0.1)

Go back to all versions of this package