micronaut-core management endpoints vulnerable to drive-by localhost attack
Key facts
- Attack vector
- Local
- Privileges required
- Low
- User interaction
- None
- Attack complexity
- Low
- Impact type
- —
- Confidentiality · integrity · availability
- High · High · High
- Fix status
- Fixed
Attack profile from CVSS 3.1 · NVD. Fix status from CNA and GitHub.
Summary
Micronaut Framework is a modern, JVM-based, full stack Java framework designed for building modular, easily testable JVM applications with support for Java, Kotlin and the Groovy language. Enabled but unsecured management endpoints are susceptible to drive-by localhost attacks. While not typical of a production application, these attacks may have more impact on a development environment where such endpoints may be flipped on without much thought. A malicious/compromised website can make HTTP requests to `localhost`. Normally, such requests would trigger a CORS preflight check which would prevent the request; however, some requests are "simple" and do not require a preflight check. These endpoints, if enabled and not secured, are vulnerable to being triggered. Production environments typically disable unused endpoints and secure/restrict access to needed endpoints. A more likely victim is the developer in their local development host, who has enabled endpoints without security for the sake of easing development. This issue has been addressed in version 3.8.3. Users are advised to upgrade.
Why it matters now
SSVC decision points
CISA ADP · SSVC 2.0.3
- Exploitation
- None
- Automatable
- No
- Technical impact
- Partial
The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.
Affected products
| Vendor | Product | Affected versions | Fixed in | Status | Source |
|---|---|---|---|---|---|
| micronaut-projects | micronaut-core | before 3.8.3 | 3.8.3 | Patch available | CNA |
| — | io.micronaut:micronaut-http-server (Maven) | before 3.8.3 | 3.8.3 | Patch available | GHSA-583g-g682-crxf |
| — | io.micronaut:micronaut-http-server-netty (Maven) | before 3.8.3 | 3.8.3 | Patch available | GHSA-583g-g682-crxf |
| — | io.micronaut:micronaut-http-server-tck (Maven) | before 3.8.3 | 3.8.3 | Patch available | GHSA-583g-g682-crxf |
- micronaut-core Vendormicronaut-projects Affected before 3.8.3 Fixed in 3.8.3 Patch available CNA
- io.micronaut:micronaut-http-server (Maven) Vendor— Affected before 3.8.3 Fixed in 3.8.3 Patch available GHSA-583g-g682-crxf
- io.micronaut:micronaut-http-server-netty (Maven) Vendor— Affected before 3.8.3 Fixed in 3.8.3 Patch available GHSA-583g-g682-crxf
- io.micronaut:micronaut-http-server-tck (Maven) Vendor— Affected before 3.8.3 Fixed in 3.8.3 Patch available GHSA-583g-g682-crxf
CPE configurations NVD · 1
| CPE | Versions | Role | Vendor |
|---|---|---|---|
| cpe:2.3:a:objectcomputing:micronaut:*:*:*:*:*:*:*:* | before 3.8.3 | Vulnerable | micronaut-projects |
- cpe:2.3:a:objectcomputing:micronaut:*:*:*:*:*:*:*:* Versions before 3.8.3 Vulnerable ·micronaut-projects
Remediation
- Fix · CNA micronaut-core (micronaut-projects) Fixed in 3.8.3
- Fix · GHSA-583g-g682-crxf io.micronaut:micronaut-http-server (Maven) Fixed in 3.8.3 Advisory →
- Fix · GHSA-583g-g682-crxf io.micronaut:micronaut-http-server-netty (Maven) Fixed in 3.8.3 Advisory →
- Fix · GHSA-583g-g682-crxf io.micronaut:micronaut-http-server-tck (Maven) Fixed in 3.8.3 Advisory →
Timeline
- 2026-10-02 Threatist record created from CVE-2024-23639
- 2026-10-03 Alias added: GHSA-583g-g682-crxf
References
Advisory 2
More micronaut-projects Micronaut vulnerabilities
- TI-2026-25460 Micronaut vulnerable to DoS via crafted form-urlencoded body binding with descending array indices CVSS 4.0HIGH 8.2
- TI-2020-06133 All versions of io.micronaut:micronaut-http-client before 1.2.11 and all versions from… CVSS 3.1CRITICAL 9.8
- TI-2026-25459 Micronaut Framework vulnerable to a Denial of Service in HTML error response caching CVSS 3.1HIGH 7.5
- TI-2021-12436 Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') in micronaut-core CVSS 3.1HIGH 7.5
- TI-2022-06076 Memory leak in micronaut-core CVSS 3.1MEDIUM 5.3
Sources
- CVE-2024-23639 · CVE Program
- CVE-2024-23639 · NVD
- FIRST EPSS
- GHSA-583g-g682-crxf · GitHub Advisory Database · CC BY 4.0
This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences