Advisories for Maven/Io.micronaut/Micronaut-Http-Client package

DefaultHttpClient follows redirects and forwards Authorization, Cookie, and Proxy-Authorization headers to redirect targets across domain boundaries. The blocklist only filters Host/Connection/TE/CT/CL. Additionally, no maximum redirect count exists, enabling infinite loop DoS. Affected: DefaultHttpClient.java lines 231-245, 1591, 2071 Suggested fix: Strip sensitive headers on cross-domain redirects

The Netty-based Micronaut HTTP Client does not impose a limit on HTTP redirections, potentially allowing an infinite redirect loop that could lead to a denial-of-service attack.

Sending an invalid Content Type header leads to memory leak in DefaultArgumentConversionContext as this type is erroneously used in static state.

Micronaut is a JVM-based, full stack Java framework designed for building JVM applications. With a basic configuration, it is possible to access any file from a filesystem, using "/../../" in the URL. This occurs because Micronaut does not restrict file access to configured paths.

The Micronaut HTTP client is vulnerable to HTTP Request Header Injection due to not validating request headers passed to the client.