The vulnerability in Micronaut's DefaultHttpClient causes it to follow HTTP redirects while forwarding sensitive headers (Authorization, Cookie, Proxy-Authorization) to redirect targets even across domain boundaries. The implemented blocklist only filters certain headers (Host, Connection, TE, CT, CL), which is insufficient to prevent leakage of sensitive credentials. Furthermore, the client does not enforce a maximum redirect count, enabling attackers to trigger infinite redirect loops leading to denial of service. The issue affects DefaultHttpClient.java in specified lines and has been addressed by stripping sensitive headers on cross-domain redirects in patched versions of Micronaut 3.10.6 and later, 4.10.24 and later, and 5.0.1 and later.

Sensitive authentication headers can be leaked to unintended domains during HTTP redirects, potentially exposing credentials or session tokens. The lack of a maximum redirect count allows attackers to cause infinite redirect loops, resulting in denial of service conditions. The vulnerability does not impact data integrity or availability beyond the described denial of service and confidentiality risks.

Official patches are available and should be applied to remediate this vulnerability. Upgrade to Micronaut versions 3.10.6 or later, 4.10.24 or later, or 5.0.1 or later, depending on your major version. No workarounds are provided. Applying these updates will ensure sensitive headers are stripped on cross-domain redirects and that redirect loops are prevented by enforcing a maximum redirect count.