Skip to content

fix(deps): update micronaut.version [security] - #10325

Open
renovate-bot wants to merge 1 commit into
GoogleCloudPlatform:mainfrom
renovate-bot:renovate/micronaut.version
Open

fix(deps): update micronaut.version [security]#10325
renovate-bot wants to merge 1 commit into
GoogleCloudPlatform:mainfrom
renovate-bot:renovate/micronaut.version

Conversation

@renovate-bot

@renovate-bot renovate-bot commented Aug 8, 2026

Copy link
Copy Markdown
Contributor

This PR contains the following updates:

Package Change Age Confidence
io.micronaut:micronaut-http-client (source) 3.10.3 → 3.10.7 age confidence
io.micronaut:micronaut-inject (source) 3.10.3 → 3.10.6 age confidence
io.micronaut:micronaut-http-client (source) 3.10.4 → 3.10.7 age confidence
io.micronaut:micronaut-inject (source) 3.10.4 → 3.10.6 age confidence

Warning

Some dependencies could not be looked up. Check the Dependency Dashboard for more information.

Micronaut doesn't set a maximum redirect count for its HTTP Client, enabling infinite loop DoS

GHSA-387m-935m-c4vw

More information

Details

The Netty-based Micronaut HTTP Client does not impose a limit on HTTP redirections, potentially allowing an infinite redirect loop that could lead to a denial-of-service attack.

Patches

The following versions are patched:

  • For Micronaut 5, versions equal or greater than 5.0.1 >=
  • For Micronaut 4, versions equal or greater than 4.10.24 >=
  • For Micronaut 3, versions equal or greater than 3.10.7 >=
Workarounds

No

Resources

Micronaut 5 Patch: micronaut-projects/micronaut-core@6e88a97
Micronaut 4 Patch: micronaut-projects/micronaut-core@f1dffff
Micronaut 3 Patch: micronaut-projects/micronaut-core@c06a271

Severity

  • CVSS Score: 7.5 / 10 (High)
  • Vector String: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

References

This data is provided by the GitHub Advisory Database (CC-BY 4.0).

Micronaut: DefaultHttpClient follows redirects, forwarding Authorization, Cookie, and Proxy-Authorization headers

GHSA-q6gh-6v2r-hjv3

More information

Details

Impact

DefaultHttpClient follows redirects and forwards Authorization, Cookie, and Proxy-Authorization headers to redirect targets across domain boundaries. The blocklist only filters Host/Connection/TE/CT/CL.
Additionally, no maximum redirect count exists, enabling infinite loop DoS.
Affected: DefaultHttpClient.java lines 231-245, 1591, 2071

Suggested fix: Strip sensitive headers on cross-domain redirects

Patches

It has been patched for versions:

For Micronaut 5, versions equal or greater than 5.0.1 >=
For Micronaut 4, versions equal or greater than 4.10.24 >=
For Micronaut 3, versions equal or greater than 3.10.6 >=

Workarounds

No

References

Micronaut 5 Patch: micronaut-projects/micronaut-core@9770328
Micronaut 4 Patch: micronaut-projects/micronaut-core@70cab4b
Micronaut 3 Patch: micronaut-projects/micronaut-core@64e5397

Severity

  • CVSS Score: 6.8 / 10 (Medium)
  • Vector String: CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:C/C:H/I:N/A:N

References

This data is provided by the GitHub Advisory Database (CC-BY 4.0).

Micronaut has Unbounded bundleCache in ResourceBundleMessageSource that Allows Memory Exhaustion via Accept-Language Header

CVE-2026-44242 / GHSA-3rfq-4wpf-qqw3

More information

Details

Summary

ResourceBundleMessageSource maintains two caches: messageCache (bounded at 100 entries via ConcurrentLinkedHashMap) and bundleCache (unbounded ConcurrentHashMap). The bundleCache is keyed by (Locale, baseName) where the locale originates from the HTTP Accept-Language header. In applications that explicitly register a ResourceBundleMessageSource bean and serve HTML error responses, an unauthenticated attacker can exhaust heap memory by sending requests with large numbers of unique Accept-Language values, each causing a new entry in the unbounded bundleCache. Unlike GHSA-2hcp-gjrf-7fhc and the sibling messageCache (both bounded), bundleCache was not updated to use a bounded cache implementation.

Details

The bundleCache is initialized in inject/src/main/java/io/micronaut/context/i18n/ResourceBundleMessageSource.java at line 150:

// ResourceBundleMessageSource.java:139-152
protected Map<MessageKey, Optional<String>> buildMessageCache() {
    return new ConcurrentLinkedHashMap.Builder<MessageKey, Optional<String>>()
            .maximumWeightedCapacity(100)    // ← BOUNDED ✓
            .build();
}

protected Map<MessageKey, Optional<ResourceBundle>> buildBundleCache() {
    return new ConcurrentHashMap<>(18);      // ← UNBOUNDED ✗
}

The resolveBundle() method at line 169 inserts into bundleCache with no eviction policy:

// ResourceBundleMessageSource.java:169-185
private Optional<ResourceBundle> resolveBundle(Locale locale) {
    MessageKey key = new MessageKey(locale, baseName);
    final Optional<ResourceBundle> resourceBundle = bundleCache.get(key);
    if (resourceBundle != null) {
        return resourceBundle;
    } else {
        Optional<ResourceBundle> opt;
        try {
            opt = Optional.of(ResourceBundle.getBundle(baseName, locale, getClassLoader()));
        } catch (MissingResourceException e) {
            opt = Optional.empty();
        }
        bundleCache.put(key, opt);    // NO SIZE CHECK — unbounded growth
        return opt;
    }
}

The attack path requires:

  1. The application registers a ResourceBundleMessageSource bean (non-default, requires explicit user configuration).
  2. The attacker sends requests that trigger HTML error responses — i.e., requests with Accept: text/html to any URL that returns an error (e.g., 404 for any non-existent path).
  3. Each request uses a unique Accept-Language value (e.g., zz-AA, zz-AB, …).
  4. DefaultHtmlErrorResponseBodyProvider.error() calls messageSource.getMessage(code, locale) → CompositeMessageSource delegates to ResourceBundleMessageSource → resolveBundle(locale) inserts one entry per unique locale into bundleCache.

For locales that don't match any bundle file, ResourceBundle.getBundle() throws MissingResourceException and Optional.empty() is stored — a low-cost sentinel. For locales that DO match a bundle, a full ResourceBundle object is retained in memory. In either case, the map itself and the MessageKey objects grow without bound.

Note: the messageCache is bounded at 100 entries but does not prevent bundleCache growth, as resolveBundle() is called directly (bypassing messageCache) whenever a messageCache miss occurs.

PoC

Against a Micronaut application with a ResourceBundleMessageSource bean registered (e.g., @Bean ResourceBundleMessageSource messages() { return new ResourceBundleMessageSource("messages"); }):

##### Flood bundleCache with unique locales via HTML error path
for i in $(seq 1 100000); do
  curl -s -o /dev/null \
    -H "Accept: text/html" \
    -H "Accept-Language: zz-$(printf '%04d' $i)" \
    "http://localhost:8080/nonexistent-path-$(printf '%06d' $i)" &
  [ $((i % 200)) -eq 0 ] && wait
done
wait

Each unique zz-XXXX tag creates one new bundleCache entry. The MessageKey (Locale + baseName) and map overhead cost approximately 100-200 bytes per entry. At 100,000 entries, heap consumption from the cache alone reaches roughly 20 MB — significant in resource-constrained deployments. If a locale matches a bundle file, retained ResourceBundle objects cost substantially more per entry.

Impact
  • Only affects applications that explicitly register a ResourceBundleMessageSource bean (not the default configuration).
  • Requires the ability to send HTTP requests with Accept: text/html headers and control over the Accept-Language value.
  • Memory grows approximately 100-200 bytes per novel locale (for non-matching locales) up to several KB per locale if bundles are found. Sustained attack over time causes gradual heap exhaustion.
  • Partial availability impact (A:L) under sustained attack in long-running services.
Recommended Fix

Apply the same bounded-cache pattern used for the sibling messageCache:

// In ResourceBundleMessageSource.java — replace buildBundleCache()
protected Map<MessageKey, Optional<ResourceBundle>> buildBundleCache() {
    return new ConcurrentLinkedHashMap.Builder<MessageKey, Optional<ResourceBundle>>()
            .maximumWeightedCapacity(50)    // small — one entry per (locale, baseName)
            .build();
}

The number of distinct resource bundle files is bounded at compile time; a limit of 50 entries is more than sufficient for any realistic i18n configuration while fully preventing unbounded growth.

Severity

  • CVSS Score: 3.7 / 10 (Low)
  • Vector String: CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:L

References

This data is provided by the GitHub Advisory Database (CC-BY 4.0).

Release Notes

micronaut-projects/micronaut-core (io.micronaut:micronaut-http-client)

v3.10.7: Micronaut Core 3.10.7

Compare Source

🚨 Security

Full Changelog: micronaut-projects/micronaut-core@v3.10.6...v3.10.7

v3.10.6: Micronaut Core 3.10.6

Compare Source

Security 👮🏻‍♂️🚨

This release contains fixes for this security advisory:

*Unbounded bundleCache in ResourceBundleMessageSource Allows Memory Exhaustion via Accept-Language Header

Full Changelog: micronaut-projects/micronaut-core@v3.10.5...v3.10.6

v3.10.5: Micronaut Core 3.10.5

Compare Source

What's Changed
Other Changes 💡

Full Changelog: micronaut-projects/micronaut-core@v3.10.4...v3.10.5

v3.10.4: Micronaut Core 3.10.4

Compare Source

What's Changed
Bug Fixes 🐞
Other Changes 💡
Docs 📖
Netty Upgrade
TCK ✅
New Contributors

Full Changelog: micronaut-projects/micronaut-core@v4.3.12...v3.10.4

Configuration

📅 Schedule: (UTC)

  • Branch creation
    • At any time (no schedule defined)
  • Automerge
    • At any time (no schedule defined)

🚦 Automerge: Enabled.

♻ Rebasing: Whenever PR is behind base branch, or you tick the rebase/retry checkbox.

👻 Immortal: This PR will be recreated if closed unmerged. Get config help if that's undesired.

  • If you want to rebase/retry this PR, check this box

This PR was generated by Mend Renovate. View the repository job log.

@forking-renovate forking-renovate Bot added lang: java Issues specific to Java. type:security labels Aug 8, 2026
@renovate-bot
renovate-bot requested review from a team and yoshi-approver as code owners August 8, 2026 19:28
@trusted-contributions-gcf trusted-contributions-gcf Bot added the kokoro:force-run Add this label to force Kokoro to re-run the tests. label Aug 8, 2026
@product-auto-label product-auto-label Bot added samples Issues that are directly related to samples. api: appengine Issues related to the App Engine Admin API API. labels Aug 8, 2026
@kokoro-team kokoro-team removed the kokoro:force-run Add this label to force Kokoro to re-run the tests. label Aug 8, 2026
gemini-code-assist[bot]
gemini-code-assist Bot reviewed Aug 8, 2026
View reviewed changes

@gemini-code-assist gemini-code-assist Bot left a comment

Copy link
Copy Markdown
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Code Review

This pull request updates the Micronaut dependency version to 3.10.6 across multiple pom.xml files. The reviewer identified that this version does not fully resolve a known infinite loop DoS vulnerability in the Netty-based HTTP Client (GHSA-387m-935m-c4vw), and recommended upgrading to version 3.10.7 or higher instead.

Comment thread appengine-java11/micronaut-helloworld/pom.xml
<maven.compiler.target>11</maven.compiler.target>
<maven.compiler.source>11</maven.compiler.source>
<micronaut.version>3.10.4</micronaut.version>
<micronaut.version>3.10.6</micronaut.version>

@gemini-code-assist gemini-code-assist Bot Aug 8, 2026

Copy link
Copy Markdown
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

security-high high

The update to 3.10.6 does not fully address all security vulnerabilities mentioned in the PR description. Specifically, the infinite loop DoS vulnerability in the Netty-based HTTP Client (GHSA-387m-935m-c4vw) is only patched in Micronaut version 3.10.7 or higher. Please upgrade to 3.10.7 to ensure all vulnerabilities are resolved.

Suggested change
<micronaut.version>3.10.6</micronaut.version>
<micronaut.version>3.10.7</micronaut.version>

Comment thread flexible/java-17/micronaut-helloworld/pom.xml
<maven.compiler.target>11</maven.compiler.target>
<maven.compiler.source>11</maven.compiler.source>
<micronaut.version>3.10.3</micronaut.version>
<micronaut.version>3.10.6</micronaut.version>

@gemini-code-assist gemini-code-assist Bot Aug 8, 2026

Copy link
Copy Markdown
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

security-high high

The update to 3.10.6 does not fully address all security vulnerabilities mentioned in the PR description. Specifically, the infinite loop DoS vulnerability in the Netty-based HTTP Client (GHSA-387m-935m-c4vw) is only patched in Micronaut version 3.10.7 or higher. Please upgrade to 3.10.7 to ensure all vulnerabilities are resolved.

Suggested change
<micronaut.version>3.10.6</micronaut.version>
<micronaut.version>3.10.7</micronaut.version>

Comment thread flexible/java-25/micronaut-helloworld/pom.xml
<maven.compiler.target>21</maven.compiler.target>
<maven.compiler.source>21</maven.compiler.source>
<micronaut.version>3.10.3</micronaut.version>
<micronaut.version>3.10.6</micronaut.version>

@gemini-code-assist gemini-code-assist Bot Aug 8, 2026

Copy link
Copy Markdown
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

security-high high

The update to 3.10.6 does not fully address all security vulnerabilities mentioned in the PR description. Specifically, the infinite loop DoS vulnerability in the Netty-based HTTP Client (GHSA-387m-935m-c4vw) is only patched in Micronaut version 3.10.7 or higher. Please upgrade to 3.10.7 to ensure all vulnerabilities are resolved.

Suggested change
<micronaut.version>3.10.6</micronaut.version>
<micronaut.version>3.10.7</micronaut.version>

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Reviewers

@yoshi-approver yoshi-approver Awaiting requested review from yoshi-approver yoshi-approver is a code owner
1 more reviewer
@gemini-code-assist gemini-code-assist[bot] gemini-code-assist[bot] left review comments
Reviewers whose approvals may not affect merge requirements

At least 1 approving review is required to merge this pull request.

Assignees

@shruti-mantri shruti-mantri

Labels

api: appengine Issues related to the App Engine Admin API API. lang: java Issues specific to Java. samples Issues that are directly related to samples. type:security

Projects

None yet

Milestone

No milestone

Development

Successfully merging this pull request may close these issues.

3 participants

@renovate-bot @kokoro-team @shruti-mantri