GHSA-387m-935m-c4vw
HighAdvisory
Published 9 Jul 2026In the index since 8 Sept 2026
- Severity
- High
- worst across findings
- CVSS
- 7.5
- base score, highest
- EPSS
- —
- probability of exploitation
- CISA KEV
- Not listed
- no confirmed exploitation
- Charts affected
- 10
- of 17,781 indexed, latest versions
- Container images
- 32
- deployed by those charts
- Fix available
- 1 of 1
- affected package
Micronaut doesn't set a maximum redirect count for its HTTP Client, enabling infinite loop DoS
Carried by container images the latest versions of 10 of 17,781 indexed charts deploy, on 32 images.
| Affected package | Affected versions | Fixed in | Images |
|---|---|---|---|
| micronaut-http-clientmaven | 3.9.1, 3.10.0, 3.10.3, 3.10.4+4 more | 3.10.7, 4.10.24 | 32 |
- OSV records
- GHSA-387m-935m-c4vw
Charts affected
10 by stars
| Chart | Latest | Affected images | Radar Score |
|---|---|---|---|
| airbyte-api-serverairbyteVerified publisher | 0.293.4 | 1 of 1See more | 854 |
| connector-rollout-workerairbyteVerified publisher | 1.9.2 | 1 of 1See more | 829 |
| airbyteairbyte-v2Verified publisher | 2.2.0 | 6 of 10See more | 12,473 |
| airbyte-data-planeairbyte-v2Verified publisher | 2.2.0 | 1 of 1See more | 790 |
| consent-facadefiware | 0.1.1 | 1 of 1See more | 2,475 |
| contract-managementfiware | 3.5.36 | 1 of 1See more | 2,411 |
| tm-forum-apifiware | 0.17.15 | 19 of 19See more | 35,112 |
| trusted-issuers-registryfiware | 0.13.0 | 1 of 1See more | 7,087 |
| mod-agreementsfolio-org | 0.1.32 | 1 of 1See more | 1,874 |
| gridgain9gridgainVerified publisher | 1.1.10 | 1 of 2See more | 3,199 |
Container images carrying it
32 by charts deploying them
A fixed version is listed for 1 of the 1 affected package.
| Container image | Digest | Package | Fixed in | Used by |
|---|---|---|---|---|
| airbyte/ | 119be7bfb719 | micronaut-http-client | 4.10.24 | 2 |
| airbyte/ | e1c5e7cfec8a | micronaut-http-client | 4.10.24 | 1 |
| airbyte/ | f71cf4e185d5 | micronaut-http-client | 4.10.24 | 1 |
| airbyte/ | d42813fcc191 | micronaut-http-client | 4.10.24 | 1 |
| airbyte/ | d97b67a1346d | micronaut-http-client | 4.10.24 | 1 |
| airbyte/ | 70e125498a1c | micronaut-http-client | 4.10.24 | 1 |
| airbyte/ | 8060b88b29c8 | micronaut-http-client | 4.10.24 | 1 |
| airbyte/ | 42093cff86e9 | micronaut-http-client | 4.10.24 | 1 |
| folioci/ | 29c3f233a498 | micronaut-http-client | 3.10.7 | 1 |
| gridgain/ | 95018390077b | micronaut-http-client | 3.10.7 | 1 |
| quay.io/ | 2bcfcf874451 | micronaut-http-client | 4.10.24 | 1 |
| quay.io/ | 6b25aac03414 | micronaut-http-client | 3.10.7 | 1 |
| quay.io/ | 81e7025dc16d | micronaut-http-client | 3.10.7 | 1 |
| quay.io/ | dee901f1f75d | micronaut-http-client | 3.10.7 | 1 |
| quay.io/ | d3519cebecd0 | micronaut-http-client | 3.10.7 | 1 |
| quay.io/ | 7d6969a7393a | micronaut-http-client | 3.10.7 | 1 |
| quay.io/ | 52db89f17863 | micronaut-http-client | 3.10.7 | 1 |
| quay.io/ | e409338726da | micronaut-http-client | 3.10.7 | 1 |
| quay.io/ | 3a5d6dd30f1d | micronaut-http-client | 3.10.7 | 1 |
| quay.io/ | 42c81c291f6f | micronaut-http-client | 3.10.7 | 1 |
| quay.io/ | d9ca3a334352 | micronaut-http-client | 3.10.7 | 1 |
| quay.io/ | b0d853627c59 | micronaut-http-client | 3.10.7 | 1 |
| quay.io/ | 62a5acb63fd1 | micronaut-http-client | 3.10.7 | 1 |
| quay.io/ | 553b4a47730b | micronaut-http-client | 3.10.7 | 1 |
| quay.io/ | dd1778ad6203 | micronaut-http-client | 3.10.7 | 1 |
| quay.io/ | 74b0fad9e155 | micronaut-http-client | 3.10.7 | 1 |
| quay.io/ | 4be54e8cb5c0 | micronaut-http-client | 3.10.7 | 1 |
| quay.io/ | d2091785d544 | micronaut-http-client | 3.10.7 | 1 |
| quay.io/ | 1b74a2f7ba67 | micronaut-http-client | 3.10.7 | 1 |
| quay.io/ | 42f190c42926 | micronaut-http-client | 3.10.7 | 1 |
| quay.io/ | a8a9ec461034 | micronaut-http-client | 3.10.7 | 1 |
| quay.io/ | be844c750c7e | micronaut-http-client | 4.10.24 | 1 |