Description
All versions of io.micronaut:micronaut-http-client before 1.2.11 and all versions from 1.3.0 before 1.3.2 are vulnerable to HTTP Request Header Injection due to not validating request headers passed to the client.
Remediation
References
https://github.com/micronaut-projects/micronaut-core/commit/9d1eff5c8df1d6cda1fe00ef046729b2a6abe7f1
https://github.com/micronaut-projects/micronaut-core/security/advisories/GHSA-694p-xrhg-x3wm
https://snyk.io/vuln/SNYK-JAVA-IOMICRONAUT-561342
Related Vulnerabilities
CVE-2023-26473 Vulnerability in maven package org.xwiki.platform:xwiki-platform-query-manager
CVE-2017-5662 Vulnerability in maven package org.eclipse.birt.runtime:org.apache.batik.dom
CVE-2023-0044 Vulnerability in maven package io.quarkus:quarkus-vertx-http
CVE-2021-43841 Vulnerability in maven package org.xwiki.platform:xwiki-platform-oldcore
CVE-2019-0205 Vulnerability in maven package org.webjars.bower:thrift