Micronaut HTTP Client sensitive header leak and DoS in DefaultHttpClient

Executive brief

The Micronaut HTTP client incorrectly handles web redirects by sending sensitive login credentials and session cookies to external websites. This could allow a malicious site to steal user authentication tokens or private session data if a legitimate request is redirected to it. Additionally, the client lacks a limit on redirects, which could be used to crash an application by forcing it into an infinite loop.

Technical details

The DefaultHttpClient in Micronaut fails to strip sensitive headers (Authorization, Cookie, and Proxy-Authorization) when following redirects across different domain boundaries. The internal blocklist only filtered Host, Connection, TE, Content-Type, and Content-Length, allowing credentials to be leaked to third-party redirect targets. Furthermore, the client did not enforce a maximum redirect count, creating a secondary vulnerability where an attacker could trigger an infinite redirect loop leading to a Denial of Service (DoS). The issue is resolved by stripping sensitive headers on cross-domain redirects and implementing redirect limits.

Affected products

• Micronaut Foundation Micronaut HTTP Client >= 1.2.8, < 3.10.6; >= 4.0.0-M1, < 4.10.24; >= 5.0.0-M1, < 5.0.1

Timeline

• 2026-06-01: disclosed: Initial disclosure to repository
• 2026-07-09: advisory: GitHub Advisory published

References

• https://api.github.com/users/sdelamo
• https://github.com/sdelamo
• https://api.github.com/users/sdelamo/gists%7B/gist_id%7D
• https://api.github.com/users/sdelamo/repos
• https://avatars.githubusercontent.com/u/864788?v=4
• https://api.github.com/users/sdelamo/events%7B/privacy%7D