mint: Content-Length header accepts non-RFC "+" sign prefix

Summary Mint's HTTP/1 client accepts Content-Length header values with a leading + sign e.g. +0, +123, which RFC 7230 forbids Content-Length = 1DIGIT. On a connection shared with a strict fronting proxy or load balancer, this parser disagreement is a response-smuggling primitive: the proxy frames...

Micronaut: DefaultHttpClient follows redirects, forwarding Authorization, Cookie, and Proxy-Authorization headers

Impact DefaultHttpClient follows redirects and forwards Authorization, Cookie, and Proxy-Authorization headers to redirect targets across domain boundaries. The blocklist only filters Host/Connection/TE/CT/CL. Additionally, no maximum redirect count exists, enabling infinite loop DoS. Affected:...

com.agorapulse:micronaut-snitch (3.0.0.rc1), io.micronaut.aws:micronaut-function-client-aws (>=5.0.0-m1, <=5.0.0) +209 more potentially affected by unknown CVE via io.micronaut:micronaut-http-client (>=5.0.0-m1, <=5.0.0)

io.micronaut:micronaut-http-client MAVEN version =5.0.0-m1, =5.0.0-m1, =5.0.0-m1, =6.0.0-m1, =6.0.0-m1, =5.0.0-m1, =5.0.0-m1, =8.0.0-m1, =8.0.0-m1, =8.0.0-m1, =8.0.0-m1, =8.0.0-m1, =8.0.0-m1, =8.0.0-m1, =2.0.0-m1, =2.0.0 and more Source cves: unknown CVE Source advisory: OSV:GHSA-Q6GH-...

com.c0x12c:module-ai-image (>=0.12.0, <=0.16.8), com.c0x12c:module-ai-module-impl (>=0.5.0, <=0.16.8) +275 more potentially affected by unknown CVE via io.micronaut:micronaut-http-client (>=4.0.0-m1, <=4.10.23)

io.micronaut:micronaut-http-client MAVEN version =4.0.0-m1, =0.12.0, =0.5.0, =0.5.0, =0.5.0, =0.5.0, =0.5.0, =0.5.0, =0.10.0, =0.8.0, =0.0.12, =0.0.14 - com.jongsoft.finance:bpmn-process 3.2.0 - com.jongsoft.finance:core 3.2.0 - com.jongsoft.finance:domain 3.2.0 - com.jongsoft.finance:fintrack-ap...

Insufficiently Protected Credentials

Overview Affected versions of this package are vulnerable to Insufficiently Protected Credentials in the DefaultHttpClient process, which follows redirects and forwards sensitive headers such as Authorization, Cookie, and Proxy-Authorization to redirect targets across domain boundaries. An attack...

com.agorapulse:micornaut-worker-queues-sqs-v1 (1.0.1), com.agorapulse:micronaut-aws-sdk-ag-ws (>=1.3.7.6, <=2.1.12-micronaut-1.0) +123 more potentially affected by unknown CVE via io.micronaut:micronaut-http-client (>=1.2.8, <=3.10.5)

io.micronaut:micronaut-http-client MAVEN version =1.2.8, =1.3.7.6, =1.3.7.6, =2.0.8-micronaut-1.0, =1.3.7.6, =1.3.7.6, =1.6.2-micronaut-1.0, =2.1.0-micronaut-1.0, =1.3.7.6, =1.5.0, =2.0.3-micronaut-1.0, =1.3.7.6, =1.3.7.6, =1.3.7.6, =1.3.7.6, =2.1.12-micronaut-1.0 and more Source cves: unknown...

com.agorapulse:micornaut-worker-queues-sqs-v1 (1.0.1), com.agorapulse:micronaut-aws-sdk-ag-ws (>=1.3.7.6, <=2.1.12-micronaut-1.0) +123 more potentially affected by unknown CVE via io.micronaut:micronaut-http-client (>=1.2.8, <=3.10.5)

io.micronaut:micronaut-http-client MAVEN version =1.2.8, =1.3.7.6, =1.3.7.6, =2.0.8-micronaut-1.0, =1.3.7.6, =1.3.7.6, =1.6.2-micronaut-1.0, =2.1.0-micronaut-1.0, =1.3.7.6, =1.5.0, =2.0.3-micronaut-1.0, =1.3.7.6, =1.3.7.6, =1.3.7.6, =1.3.7.6, =2.1.12-micronaut-1.0 and more Source cves: unknown...

com.agorapulse:micronaut-snitch (3.0.0.rc1), io.micronaut.aws:micronaut-function-client-aws (>=5.0.0-m1, <=5.0.0) +209 more potentially affected by unknown CVE via io.micronaut:micronaut-http-client (>=5.0.0-m1, <=5.0.0)

io.micronaut:micronaut-http-client MAVEN version =5.0.0-m1, =5.0.0-m1, =5.0.0-m1, =6.0.0-m1, =6.0.0-m1, =5.0.0-m1, =5.0.0-m1, =8.0.0-m1, =8.0.0-m1, =8.0.0-m1, =8.0.0-m1, =8.0.0-m1, =8.0.0-m1, =8.0.0-m1, =2.0.0-m1, =2.0.0 and more Source cves: unknown CVE Source advisory: SNYK:JAVA-IOMI...

com.agorapulse:micronaut-snitch (3.0.0.rc1), io.micronaut.aws:micronaut-function-client-aws (>=5.0.0-m1, <=5.0.0) +209 more potentially affected by unknown CVE via io.micronaut:micronaut-http-client (>=5.0.0-m1, <=5.0.0)

io.micronaut:micronaut-http-client MAVEN version =5.0.0-m1, =5.0.0-m1, =5.0.0-m1, =6.0.0-m1, =6.0.0-m1, =5.0.0-m1, =5.0.0-m1, =8.0.0-m1, =8.0.0-m1, =8.0.0-m1, =8.0.0-m1, =8.0.0-m1, =8.0.0-m1, =8.0.0-m1, =2.0.0-m1, =2.0.0 and more Source cves: unknown CVE Source advisory: GHSA-Q6GH-6V2R...

com.agorapulse:micronaut-snitch (3.0.0.rc1), io.micronaut.aws:micronaut-aws-distributed-configuration (>=5.0.0-m1, <=5.0.0) +228 more potentially affected by unknown CVE via io.micronaut:micronaut-http-client-core (>=5.0.0-m1, <=5.0.0)

io.micronaut:micronaut-http-client-core MAVEN version =5.0.0-m1, =5.0.0-m1, =5.0.0-m1, =5.0.0-m1, =5.0.0-m1, =5.0.0-m1, =5.0.0-m1, =5.0.0-m1, =5.0.0-m1, =6.0.0-m1, =5.0.0-m1, =6.0.0-m1, =6.0.0-m1, =6.0.0-m1, =5.0.0-m1, =5.0.1 and more Source cves: unknown CVE Source advisory:...

com.c0x12c:module-ai-image (>=0.12.0, <=0.16.8), com.c0x12c:module-ai-module-impl (>=0.5.0, <=0.16.8) +275 more potentially affected by unknown CVE via io.micronaut:micronaut-http-client (>=4.0.0-m1, <=4.10.23)

io.micronaut:micronaut-http-client MAVEN version =4.0.0-m1, =0.12.0, =0.5.0, =0.5.0, =0.5.0, =0.5.0, =0.5.0, =0.5.0, =0.10.0, =0.8.0, =0.0.12, =0.0.14 - com.jongsoft.finance:bpmn-process 3.2.0 - com.jongsoft.finance:core 3.2.0 - com.jongsoft.finance:domain 3.2.0 - com.jongsoft.finance:fintrack-ap...

GHSA-Q6GH-6V2R-HJV3 Micronaut: DefaultHttpClient follows redirects, forwarding Authorization, Cookie, and Proxy-Authorization headers

Impact DefaultHttpClient follows redirects and forwards Authorization, Cookie, and Proxy-Authorization headers to redirect targets across domain boundaries. The blocklist only filters Host/Connection/TE/CT/CL. Additionally, no maximum redirect count exists, enabling infinite loop DoS. Affected:...

com.c0x12c:module-ai-image (>=0.12.0, <=0.16.8), com.c0x12c:module-ai-module-impl (>=0.5.0, <=0.16.8) +293 more potentially affected by unknown CVE via io.micronaut:micronaut-http-client-core (>=4.0.0-m1, <=4.10.23)

io.micronaut:micronaut-http-client-core MAVEN version =4.0.0-m1, =0.12.0, =0.5.0, =0.5.0, =0.5.0, =0.5.0, =0.5.0, =0.5.0, =0.10.0, =0.8.0, =0.5.0, =0.2.15, =0.0.12, =0.0.14 - com.jongsoft.finance:bpmn-process 3.2.0 and more Source cves: unknown CVE Source advisory: SNYK:JAVA-IOMICRONAUT-17912689...

com.agorapulse:gru-micronaut (1.4.0), com.agorapulse:micronaut-slack-http (>=1.0.1-micronaut-3.0, <=1.0.4-micronaut-3.0) +195 more potentially affected by unknown CVE via io.micronaut:micronaut-http-client-core (>=2.0.0.m1, <=3.10.5)

io.micronaut:micronaut-http-client-core MAVEN version =2.0.0.m1, =1.0.1-micronaut-3.0, =1.2.0-micronaut-2.0, =1.3.0, =2.1.0, =2.0.0, =2.0.0, =2.0.0, =2.0.0, =2.0.0, =2.0.0, =2.0.0, =1.7.2976, =1.16.0, =1.38.3 and more Source cves: unknown CVE Source advisory: SNYK:JAVA-IOMICRONAUT-17912689...

com.c0x12c:module-ai-image (>=0.12.0, <=0.16.8), com.c0x12c:module-ai-module-impl (>=0.5.0, <=0.16.8) +275 more potentially affected by unknown CVE via io.micronaut:micronaut-http-client (>=4.0.0-m1, <=4.10.23)

io.micronaut:micronaut-http-client MAVEN version =4.0.0-m1, =0.12.0, =0.5.0, =0.5.0, =0.5.0, =0.5.0, =0.5.0, =0.5.0, =0.10.0, =0.8.0, =0.0.12, =0.0.14 - com.jongsoft.finance:bpmn-process 3.2.0 - com.jongsoft.finance:core 3.2.0 - com.jongsoft.finance:domain 3.2.0 - com.jongsoft.finance:fintrack-ap...

com.agorapulse:micornaut-worker-queues-sqs-v1 (1.0.1), com.agorapulse:micronaut-aws-sdk-ag-ws (>=1.3.7.6, <=2.1.12-micronaut-1.0) +123 more potentially affected by unknown CVE via io.micronaut:micronaut-http-client (>=1.2.8, <=3.10.5)

io.micronaut:micronaut-http-client MAVEN version =1.2.8, =1.3.7.6, =1.3.7.6, =2.0.8-micronaut-1.0, =1.3.7.6, =1.3.7.6, =1.6.2-micronaut-1.0, =2.1.0-micronaut-1.0, =1.3.7.6, =1.5.0, =2.0.3-micronaut-1.0, =1.3.7.6, =1.3.7.6, =1.3.7.6, =1.3.7.6, =2.1.12-micronaut-1.0 and more Source cves: unknown...

io.micronaut:micronaut-discovery-client (1.3.6), io.micronaut:micronaut-function-client (1.3.6) +1 more potentially affected by unknown CVE via io.micronaut:micronaut-http-client (1.3.6)

io.micronaut:micronaut-http-client MAVEN version 1.3.6 is affected by a known vulnerability. The following packages have a transitive dependency on io.micronaut:micronaut-http-client and may be impacted: - io.micronaut:micronaut-discovery-client 1.3.6 - io.micronaut:micronaut-function-client 1.3....

io.micronaut.starter:micronaut-micronaut-cli (2.5.8), io.micronaut.starter:micronaut-starter-api (2.5.8) +4 more potentially affected by unknown CVE via io.micronaut:micronaut-http-client (2.5.8)

io.micronaut:micronaut-http-client MAVEN version 2.5.8 is affected by a known vulnerability. The following packages have a transitive dependency on io.micronaut:micronaut-http-client and may be impacted: - io.micronaut.starter:micronaut-micronaut-cli 2.5.8 -...

io.micronaut.starter:micronaut-micronaut-cli (2.3.0), io.micronaut.starter:micronaut-starter-api (2.3.0) +3 more potentially affected by unknown CVE via io.micronaut:micronaut-http-client (2.3.0)

io.micronaut:micronaut-http-client MAVEN version 2.3.0 is affected by a known vulnerability. The following packages have a transitive dependency on io.micronaut:micronaut-http-client and may be impacted: - io.micronaut.starter:micronaut-micronaut-cli 2.3.0 -...

io.micronaut.configuration:micronaut-aws-common (1.0.0), io.micronaut.configuration:micronaut-netflix-ribbon (1.0.0) +3 more potentially affected by unknown CVE via io.micronaut:micronaut-http-client (1.0.0)

io.micronaut:micronaut-http-client MAVEN version 1.0.0 is affected by a known vulnerability. The following packages have a transitive dependency on io.micronaut:micronaut-http-client and may be impacted: - io.micronaut.configuration:micronaut-aws-common 1.0.0 -...