GHSA-387m-935m-c4vw: Micronaut doesn't set a maximum redirect count for its HTTP Client, enabling infinite loop DoS
The Micronaut HTTP Client, which is based on Netty, does not limit the number of HTTP redirects it will follow. This lack of a maximum redirect count can cause an infinite redirect loop, potentially leading to a denial-of-service (DoS) condition. Versions prior to 3.10.7 are affected. Patches are available in Micronaut versions 3.10.7 and later, 4.10.24 and later, and 5.0.1 and later.
AI Analysis
Technical Summary
The vulnerability in the Netty-based Micronaut HTTP Client arises because it does not impose a maximum redirect count. This allows an attacker to craft HTTP responses that cause the client to follow redirects indefinitely, resulting in a denial-of-service attack by exhausting resources. The issue affects versions of Micronaut HTTP Client before 3.10.7. Official patches have been released for Micronaut 3 (>=3.10.7), Micronaut 4 (>=4.10.24), and Micronaut 5 (>=5.0.1) to address this problem.
Potential Impact
An attacker can exploit this vulnerability by causing the Micronaut HTTP Client to enter an infinite redirect loop, which leads to denial-of-service by consuming excessive client resources. There is no impact on confidentiality or integrity, only availability is affected.
Mitigation Recommendations
Official patches are available and should be applied. Upgrade to Micronaut HTTP Client version 3.10.7 or later, 4.10.24 or later, or 5.0.1 or later. No workarounds are available.
GHSA-387m-935m-c4vw: Micronaut doesn't set a maximum redirect count for its HTTP Client, enabling infinite loop DoS
Description
The Micronaut HTTP Client, which is based on Netty, does not limit the number of HTTP redirects it will follow. This lack of a maximum redirect count can cause an infinite redirect loop, potentially leading to a denial-of-service (DoS) condition. Versions prior to 3.10.7 are affected. Patches are available in Micronaut versions 3.10.7 and later, 4.10.24 and later, and 5.0.1 and later.
CVSS v3.1
Affected software
Run on your own infrastructure? Check whether these packages are installed with threat-finder — our free open-source scanner.
AI-Powered Analysis
Machine-generated threat intelligence
Technical Analysis
The vulnerability in the Netty-based Micronaut HTTP Client arises because it does not impose a maximum redirect count. This allows an attacker to craft HTTP responses that cause the client to follow redirects indefinitely, resulting in a denial-of-service attack by exhausting resources. The issue affects versions of Micronaut HTTP Client before 3.10.7. Official patches have been released for Micronaut 3 (>=3.10.7), Micronaut 4 (>=4.10.24), and Micronaut 5 (>=5.0.1) to address this problem.
Potential Impact
An attacker can exploit this vulnerability by causing the Micronaut HTTP Client to enter an infinite redirect loop, which leads to denial-of-service by consuming excessive client resources. There is no impact on confidentiality or integrity, only availability is affected.
Mitigation Recommendations
Official patches are available and should be applied. Upgrade to Micronaut HTTP Client version 3.10.7 or later, 4.10.24 or later, or 5.0.1 or later. No workarounds are available.
Technical Details
- Gcve Source
- db.gcve.eu
- Osv Id
- GHSA-387m-935m-c4vw
- Osv Schema Version
- 1.4.0
- Aliases
- []
- Ecosystems
- ["Maven"]
- Database Specific Severity
- HIGH
- Cvss Version
- 3.1
Threat ID: 6a4fa9a168715ace437d3ddf
Added to database: 07/09/2026, 14:01:05 UTC
Last enriched: 07/09/2026, 14:02:27 UTC
Last updated: 07/09/2026, 20:09:07 UTC
Views: 10
Community Reviews
0 reviewsCrowdsource mitigation strategies, share intel context, and vote on the most helpful responses. Sign in to add your voice and help keep defenders ahead.
Want to contribute mitigation steps or threat intel context? Sign in or create an account to join the community discussion.
Actions
Updates to AI analysis require Pro Console access. Upgrade inside Console → Billing.
Need more coverage?
Upgrade to Pro Console for AI refresh and higher limits.
For incident response and remediation, OffSeq services can help resolve threats faster.
Latest Threats
Check if your credentials are on the dark web
Instant breach scanning across billions of leaked records. Free tier available.