fix(deps): update micronaut.version [security] - #10325

Details

The Netty-based Micronaut HTTP Client does not impose a limit on HTTP redirections, potentially allowing an infinite redirect loop that could lead to a denial-of-service attack.

Patches

The following versions are patched:

• For Micronaut 5, versions equal or greater than 5.0.1 >=
• For Micronaut 4, versions equal or greater than 4.10.24 >=
• For Micronaut 3, versions equal or greater than 3.10.7 >=

Workarounds

No

Resources

Micronaut 5 Patch: micronaut-projects/micronaut-core@6e88a97
Micronaut 4 Patch: micronaut-projects/micronaut-core@f1dffff
Micronaut 3 Patch: micronaut-projects/micronaut-core@c06a271

Severity

• CVSS Score: 7.5 / 10 (High)
• Vector String: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

References

• https://github.com/micronaut-projects/micronaut-core/security/advisories/GHSA-387m-935m-c4vw
• https://github.com/micronaut-projects/micronaut-core/commit/6e88a972718d6e1521c5b3bb7766451798dba4e3
• https://github.com/micronaut-projects/micronaut-core/commit/c06a2715ca7f78321bc3ca05f41cca78cd351320
• https://github.com/micronaut-projects/micronaut-core/commit/f1dffffec8fb5e3b7e94ae907ce0be3831e499d4
• https://github.com/advisories/GHSA-387m-935m-c4vw

This data is provided by the GitHub Advisory Database (CC-BY 4.0).

Details

Impact

DefaultHttpClient follows redirects and forwards Authorization, Cookie, and Proxy-Authorization headers to redirect targets across domain boundaries. The blocklist only filters Host/Connection/TE/CT/CL.
Additionally, no maximum redirect count exists, enabling infinite loop DoS.
Affected: DefaultHttpClient.java lines 231-245, 1591, 2071

Suggested fix: Strip sensitive headers on cross-domain redirects

Patches

It has been patched for versions:

For Micronaut 5, versions equal or greater than 5.0.1 >=
For Micronaut 4, versions equal or greater than 4.10.24 >=
For Micronaut 3, versions equal or greater than 3.10.6 >=

Workarounds

No

References

Micronaut 5 Patch: micronaut-projects/micronaut-core@9770328
Micronaut 4 Patch: micronaut-projects/micronaut-core@70cab4b
Micronaut 3 Patch: micronaut-projects/micronaut-core@64e5397

Severity

• CVSS Score: 6.8 / 10 (Medium)
• Vector String: CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:C/C:H/I:N/A:N

References

• https://github.com/micronaut-projects/micronaut-core/security/advisories/GHSA-q6gh-6v2r-hjv3
• https://github.com/micronaut-projects/micronaut-core/commit/64e539736b8168f201d868b02ace50fe14f57418
• https://github.com/micronaut-projects/micronaut-core/commit/70cab4b44fbf985faba2846091f2356b5bd70719
• https://github.com/micronaut-projects/micronaut-core/commit/9770328999f490bdfbb9e25addd45bf73d4a173a
• https://github.com/advisories/GHSA-q6gh-6v2r-hjv3

This data is provided by the GitHub Advisory Database (CC-BY 4.0).

Details

Summary

ResourceBundleMessageSource maintains two caches: messageCache (bounded at 100 entries via ConcurrentLinkedHashMap) and bundleCache (unbounded ConcurrentHashMap). The bundleCache is keyed by (Locale, baseName) where the locale originates from the HTTP Accept-Language header. In applications that explicitly register a ResourceBundleMessageSource bean and serve HTML error responses, an unauthenticated attacker can exhaust heap memory by sending requests with large numbers of unique Accept-Language values, each causing a new entry in the unbounded bundleCache. Unlike GHSA-2hcp-gjrf-7fhc and the sibling messageCache (both bounded), bundleCache was not updated to use a bounded cache implementation.

Details

The bundleCache is initialized in inject/src/main/java/io/micronaut/context/i18n/ResourceBundleMessageSource.java at line 150:

// ResourceBundleMessageSource.java:139-152
protected Map<MessageKey, Optional<String>> buildMessageCache() {
    return new ConcurrentLinkedHashMap.Builder<MessageKey, Optional<String>>()
            .maximumWeightedCapacity(100)    // ← BOUNDED ✓
            .build();
}

protected Map<MessageKey, Optional<ResourceBundle>> buildBundleCache() {
    return new ConcurrentHashMap<>(18);      // ← UNBOUNDED ✗
}

The resolveBundle() method at line 169 inserts into bundleCache with no eviction policy:

// ResourceBundleMessageSource.java:169-185
private Optional<ResourceBundle> resolveBundle(Locale locale) {
    MessageKey key = new MessageKey(locale, baseName);
    final Optional<ResourceBundle> resourceBundle = bundleCache.get(key);
    if (resourceBundle != null) {
        return resourceBundle;
    } else {
        Optional<ResourceBundle> opt;
        try {
            opt = Optional.of(ResourceBundle.getBundle(baseName, locale, getClassLoader()));
        } catch (MissingResourceException e) {
            opt = Optional.empty();
        }
        bundleCache.put(key, opt);    // NO SIZE CHECK — unbounded growth
        return opt;
    }
}

The attack path requires:

1. The application registers a ResourceBundleMessageSource bean (non-default, requires explicit user configuration).
2. The attacker sends requests that trigger HTML error responses — i.e., requests with Accept: text/html to any URL that returns an error (e.g., 404 for any non-existent path).
3. Each request uses a unique Accept-Language value (e.g., zz-AA, zz-AB, …).
4. DefaultHtmlErrorResponseBodyProvider.error() calls messageSource.getMessage(code, locale) → CompositeMessageSource delegates to ResourceBundleMessageSource → resolveBundle(locale) inserts one entry per unique locale into bundleCache.

For locales that don't match any bundle file, ResourceBundle.getBundle() throws MissingResourceException and Optional.empty() is stored — a low-cost sentinel. For locales that DO match a bundle, a full ResourceBundle object is retained in memory. In either case, the map itself and the MessageKey objects grow without bound.

Note: the messageCache is bounded at 100 entries but does not prevent bundleCache growth, as resolveBundle() is called directly (bypassing messageCache) whenever a messageCache miss occurs.

PoC

Against a Micronaut application with a ResourceBundleMessageSource bean registered (e.g., @Bean ResourceBundleMessageSource messages() { return new ResourceBundleMessageSource("messages"); }):

##### Flood bundleCache with unique locales via HTML error path
for i in $(seq 1 100000); do
  curl -s -o /dev/null \
    -H "Accept: text/html" \
    -H "Accept-Language: zz-$(printf '%04d' $i)" \
    "http://localhost:8080/nonexistent-path-$(printf '%06d' $i)" &
  [ $((i % 200)) -eq 0 ] && wait
done
wait

Each unique zz-XXXX tag creates one new bundleCache entry. The MessageKey (Locale + baseName) and map overhead cost approximately 100-200 bytes per entry. At 100,000 entries, heap consumption from the cache alone reaches roughly 20 MB — significant in resource-constrained deployments. If a locale matches a bundle file, retained ResourceBundle objects cost substantially more per entry.

Impact

• Only affects applications that explicitly register a ResourceBundleMessageSource bean (not the default configuration).
• Requires the ability to send HTTP requests with Accept: text/html headers and control over the Accept-Language value.
• Memory grows approximately 100-200 bytes per novel locale (for non-matching locales) up to several KB per locale if bundles are found. Sustained attack over time causes gradual heap exhaustion.
• Partial availability impact (A:L) under sustained attack in long-running services.

Recommended Fix

Apply the same bounded-cache pattern used for the sibling messageCache:

// In ResourceBundleMessageSource.java — replace buildBundleCache()
protected Map<MessageKey, Optional<ResourceBundle>> buildBundleCache() {
    return new ConcurrentLinkedHashMap.Builder<MessageKey, Optional<ResourceBundle>>()
            .maximumWeightedCapacity(50)    // small — one entry per (locale, baseName)
            .build();
}

The number of distinct resource bundle files is bounded at compile time; a limit of 50 entries is more than sufficient for any realistic i18n configuration while fully preventing unbounded growth.

Severity

• CVSS Score: 3.7 / 10 (Low)
• Vector String: CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:L

References

• https://github.com/micronaut-projects/micronaut-core/security/advisories/GHSA-3rfq-4wpf-qqw3
• https://github.com/micronaut-projects/micronaut-core/releases/tag/v4.10.22
• https://nvd.nist.gov/vuln/detail/CVE-2026-44242
• https://github.com/micronaut-projects/micronaut-core/releases/tag/v3.10.6
• https://github.com/micronaut-projects/micronaut-core/releases/tag/v3.8.14
• https://github.com/advisories/GHSA-3rfq-4wpf-qqw3

This data is provided by the GitHub Advisory Database (CC-BY 4.0).

v3.10.7: Micronaut Core 3.10.7

Compare Source

🚨 Security

• Fixes for security advisories:
• GHSA-387m-935m-c4vw
• GHSA-q6gh-6v2r-hjv3

Full Changelog: micronaut-projects/micronaut-core@v3.10.6...v3.10.7

v3.10.6: Micronaut Core 3.10.6

Compare Source

Security 👮🏻‍♂️🚨

This release contains fixes for this security advisory:

*Unbounded bundleCache in ResourceBundleMessageSource Allows Memory Exhaustion via Accept-Language Header

Full Changelog: micronaut-projects/micronaut-core@v3.10.5...v3.10.6

v3.10.5: Micronaut Core 3.10.5

Compare Source

What's Changed

Other Changes 💡

• Prior knowledge support for 3.8.x HTTP server by @​yawkat in #​10783
• fix: prevent denial of service submitting form-url-encoded payload by @​sdelamo in #​12411

Full Changelog: micronaut-projects/micronaut-core@v3.10.4...v3.10.5

v3.10.4: Micronaut Core 3.10.4

Compare Source

What's Changed

Bug Fixes 🐞

• Fix connection leak with read timeout during acquisition by @​yawkat in #​9449
• Fix CORS when used with API versioning. by @​wetted in #​9512
• Fix out-of-order write in HttpStreamsHandler by @​yawkat in #​9416

Other Changes 💡

• build: remove webdriver-binaries-gradle-plugin by @​sdelamo in #​9490
• Use supermethod instead of ByteBuffer#clear for binary compatibility by @​yawkat in #​9666
• Issue 9905 websphere deploy war by @​mattmoss in #​9906
• Fix @​QueryValue of LocalDateTime type for 3.10.x by @​rlconst in #​9970
• Make DefaultClassPathResourceLoader handle URLs with format jar:file:/{JAR_PATH}!/{PREFIX}!/{RESOURCE} gracefully by @​guillermocalvo in #​10092
• Broken allowed-origins-regex configuration. by @​wetted in #​9427
• Remove chatbots from 3.10.x micronaut-bom by @​timyates in #​10341
• Remove chatbots from 3.9.x micronaut-bom by @​timyates in #​10340
• Optimize cache usage in DefaultConversionService and fix race condition by @​PakhomovAlexander in #​10143
• ci: delete static analysis step by @​sdelamo in #​10631

Docs 📖

• Fix incorrect links in User Guide by @​guillermocalvo in #​9567
• don't publish to latest docs unless in the default branch by @​sdelamo in #​9673

Netty Upgrade

• Update netty to 4.1.108.Final by @​yawkat in #​10637
• Update netty to 4.1.107.Final by @​yawkat in #​10628
• Update to netty 4.1.94.Final by @​yawkat in #​9472
• Update to netty 4.1.94.Final by @​dradosevic in #​9632
• build: Netty to 4.1.93 by @​sdelamo in #​9401
• Update netty monorepo to v4.1.92.Final by @​sdelamo in #​9277

TCK ✅

• tck: LocalDateTime query value & form url encoded by @​sdelamo in #​10027
• test: Writable in Controller and Filter by @​sdelamo in #​9286
• TCK Test for JSON additional types codec by @​sdelamo in #​9272
• Remove test limitation for TCK by @​timyates in #​9317
• Add test for @Body not being required in 3.9.x by @​timyates in #​9318
• TCK tests for boolean textplain and default media type for String return type by @​sdelamo in #​9314

New Contributors

• @​dradosevic made their first contribution in #​9632
• @​rlconst made their first contribution in #​9970
• @​PakhomovAlexander made their first contribution in #​10143

Full Changelog: micronaut-projects/micronaut-core@v4.3.12...v3.10.4