All versions of io.micronaut:micronaut-http-client before 1.2.11 and all versions from…
Priority MEDIUM 46CWE-444Published · Updated
Key facts
- Attack vector
- Network
- Privileges required
- None
- User interaction
- None
- Attack complexity
- Low
- Impact type
- —
- Confidentiality · integrity · availability
- High · High · High
- Fix status
- Fixed
Attack profile from CVSS 3.1 · NVD. Fix status from CNA and GitHub.
Summary
All versions of io.micronaut:micronaut-http-client before 1.2.11 and all versions from 1.3.0 before 1.3.2 are vulnerable to HTTP Request Header Injection due to not validating request headers passed to the client.
Why it matters now
EPSS 0.01814 78th percentileScored 2026-11-07
Public exploit Yes 1 exploit referenceTagged by NVD
Fix Fixed io.micronaut:micronaut-http-client: 1.2.11io.micronaut:micronaut-http-client (Maven): 1.2.11, 1.3.2
SSVC decision points
Not available: CISA has not published SSVC decision points for this record.
Affected products
| Vendor | Product | Affected versions | Fixed in | Status | Source |
|---|---|---|---|---|---|
| — | io.micronaut:micronaut-http-client | before 1.2.11; all versions from 1.3.0 before 1.3.2 | 1.2.11 | Patch available | CNA |
| — | io.micronaut:micronaut-http-client (Maven) | before 1.2.11 | 1.2.11 | Patch available | GHSA-694p-xrhg-x3wm |
| — | io.micronaut:micronaut-http-client (Maven) | 1.3.0 to before 1.3.2 | 1.3.2 | Patch available | GHSA-694p-xrhg-x3wm |
- io.micronaut:micronaut-http-client Vendor— Affected before 1.2.11; all versions from 1.3.0 before 1.3.2 Fixed in 1.2.11 Patch available CNA
- io.micronaut:micronaut-http-client (Maven) Vendor— Affected before 1.2.11 Fixed in 1.2.11 Patch available GHSA-694p-xrhg-x3wm
- io.micronaut:micronaut-http-client (Maven) Vendor— Affected 1.3.0 to before 1.3.2 Fixed in 1.3.2 Patch available GHSA-694p-xrhg-x3wm
CPE configurations NVD · 1
| CPE | Versions | Role | Vendor |
|---|---|---|---|
| cpe:2.3:a:objectcomputing:micronaut:*:*:*:*:*:*:*:* | before 1.2.11; 1.3.0 to before 1.3.2 | Vulnerable | micronaut-projects |
- cpe:2.3:a:objectcomputing:micronaut:*:*:*:*:*:*:*:* Versions before 1.2.11; 1.3.0 to before 1.3.2 Vulnerable ·micronaut-projects
Remediation
- Fix · CNA io.micronaut:micronaut-http-client Fixed in 1.2.11
- Fix · GHSA-694p-xrhg-x3wm io.micronaut:micronaut-http-client (Maven) Fixed in 1.2.11 Advisory →
- Fix · GHSA-694p-xrhg-x3wm io.micronaut:micronaut-http-client (Maven) Fixed in 1.3.2 Advisory →
Timeline
- 2026-10-02 Threatist record created from CVE-2020-7611
- 2026-10-03 Alias added: GHSA-694p-xrhg-x3wm
References
Exploit 1
Patch 1
More micronaut-projects Micronaut vulnerabilities
- TI-2026-25460 Micronaut vulnerable to DoS via crafted form-urlencoded body binding with descending array indices CVSS 4.0HIGH 8.2
- TI-2026-25459 Micronaut Framework vulnerable to a Denial of Service in HTML error response caching CVSS 3.1HIGH 7.5
- TI-2021-12436 Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') in micronaut-core CVSS 3.1HIGH 7.5
- TI-2024-15658 micronaut-core management endpoints vulnerable to drive-by localhost attack CVSS 3.1HIGH 7.8
- TI-2022-06076 Memory leak in micronaut-core CVSS 3.1MEDIUM 5.3
Sources
- CVE-2020-7611 · CVE Program
- CVE-2020-7611 · NVD
- FIRST EPSS
- GHSA-694p-xrhg-x3wm · GitHub Advisory Database · CC BY 4.0
This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences