CVE-2020-7611

All versions of io.micronaut:micronaut-http-client before 1.2.11 and all versions from 1.3.0 before 1.3.2 are vulnerable to HTTP Request Header Injection due to not validating request headers passed to the client.

Affected

io.micronaut:micronaut-http-client

CVSS v3.1 NVD

9.8 CRITICALCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

CVSS v2.0 NVD

7.5 HIGHAV:N/AC:L/Au:N/C:P/I:P/A:P

EPSS

1.81% chance of exploitation in the next 30 days, 78th percentile

Published

2020-03-30

Updated

2024-08-04

Proof-of-concept exploits (1)

• https://snyk.io/vuln/SNYK-JAVA-IOMICRONAUT-561342

Security advisories

• micronaut-projects/micronaut-core/security/advisories/GHSA-694p-xrhg-x3wm
• advisories/GHSA-694p-xrhg-x3wm
• micronaut-projects/micronaut-core/commit/9d1eff5c8df1d6cda1fe00ef046729b2a6abe7f1

References

• CVE Record
• NVD entry