{"id":"GHSA-q6gh-6v2r-hjv3","title":"Micronaut: DefaultHttpClient follows redirects, forwarding Authorization, Cookie, and Proxy-Authorization headers","summary":"Micronaut: DefaultHttpClient follows redirects, forwarding Authorization, Cookie, and Proxy-Authorization headers","severity":"medium","cvss":6.8,"vendor":"micronaut","product":"io.micronaut:micronaut-http-client","ecosystem":"maven","affected":["io.micronaut:micronaut-http-client >= 1.2.8, < 3.10.6","io.micronaut:micronaut-http-client >= 4.0.0-M1, < 4.10.24","io.micronaut:micronaut-http-client >= 5.0.0-M1, < 5.0.1"],"patched":["io.micronaut:micronaut-http-client 3.10.6","io.micronaut:micronaut-http-client 4.10.24","io.micronaut:micronaut-http-client 5.0.1"],"published":"2026-07-09","updated":"2026-07-09","source":"GHSA","sourceUrl":"https://github.com/advisories/GHSA-q6gh-6v2r-hjv3","references":[{"url":"https://github.com/micronaut-projects/micronaut-core/security/advisories/GHSA-q6gh-6v2r-hjv3"},{"url":"https://github.com/micronaut-projects/micronaut-core/commit/64e539736b8168f201d868b02ace50fe14f57418"},{"url":"https://github.com/micronaut-projects/micronaut-core/commit/70cab4b44fbf985faba2846091f2356b5bd70719"},{"url":"https://github.com/micronaut-projects/micronaut-core/commit/9770328999f490bdfbb9e25addd45bf73d4a173a"},{"url":"https://github.com/advisories/GHSA-q6gh-6v2r-hjv3"}],"tags":["ghsa","maven"],"ingestedAt":"2026-07-09T13:51:05.205Z","slug":"GHSA-q6gh-6v2r-hjv3","body":"## Overview\n\n### Impact\n\n> DefaultHttpClient follows redirects and forwards Authorization, Cookie, and Proxy-Authorization headers to redirect targets across domain boundaries. The blocklist only filters Host/Connection/TE/CT/CL.\n> Additionally, no maximum redirect count exists, enabling infinite loop DoS.\n> Affected: DefaultHttpClient.java lines 231-245, 1591, 2071\n\n> Suggested fix: Strip sensitive headers on cross-domain redirects\n\n### Patches\nIt has been patched for versions: \n\nFor Micronaut 5, versions equal or greater than 5.0.1 >=\nFor Micronaut 4, versions equal or greater than 4.10.24 >=\nFor Micronaut 3, versions equal or greater than 3.10.6 >=\n\n### Workarounds\nNo\n\n### References\nMicronaut 5 Patch: https://github.com/micronaut-projects/micronaut-core/commit/9770328999f490bdfbb9e25addd45bf73d4a173a\nMicronaut 4 Patch: https://github.com/micronaut-projects/micronaut-core/commit/70cab4b44fbf985faba2846091f2356b5bd70719\nMicronaut 3 Patch: https://github.com/micronaut-projects/micronaut-core/commit/64e539736b8168f201d868b02ace50fe14f57418\n\n## Affected packages\n\n- `io.micronaut:micronaut-http-client >= 1.2.8, < 3.10.6`\n- `io.micronaut:micronaut-http-client >= 4.0.0-M1, < 4.10.24`\n- `io.micronaut:micronaut-http-client >= 5.0.0-M1, < 5.0.1`\n\n## Remediation\n\nUpgrade to a patched release:\n\n- `io.micronaut:micronaut-http-client 3.10.6`\n- `io.micronaut:micronaut-http-client 4.10.24`\n- `io.micronaut:micronaut-http-client 5.0.1`","depth":"sunlit","depthScore":37,"depthScoreParts":{"impact":37.4,"likelihood":0,"exploitation":0,"ransomware":0},"changes":[]}