Micronaut Framework 5.1.4 Released!
The Micronaut Foundation is excited to announce the release of Micronaut Framework 5.1.4!
It includes releases of Micronaut Core 5.1.14 and Micronaut Data 5.1.4.
We strongly recommend that users update to Micronaut Framework 5.1.4, as this release addresses several security advisories:
- Unbounded memory growth from fragmented WebSocket messages (DoS)
- Default error response always includes raw exception message with no suppression option
- HTTP request decompression-bomb DoS via unbounded gzip/deflate decoding
- SQL injection and tenant-isolation bypass via unvalidated tenant identifier in schema-based multi-tenancy
- SQL injection via unvalidated Sort/Pageable property names in native
@Querymethods
If you are using Micronaut Framework 4, update to Micronaut Platform 4.10.18, which contains fixes for these vulnerabilities. If you are using Micronaut Framework 3, update to Micronaut Core 3.10.11, which contains fixes for the Micronaut Core vulnerabilities.
For Micronaut Framework 3, the framework BOM is published in Micronaut Core. Since Micronaut Framework 4, the framework BOM is published in Micronaut Platform. Consequently, Micronaut Framework 4 and later framework releases are represented by Micronaut Platform releases.
If you haven’t yet updated to Micronaut Framework 5, this is an excellent opportunity to do so!
Please feel free to reach out to us if you need any assistance.