Micronaut Security Announcements

Micronaut framework 5.0.4 includes Micronaut Core and Netty 4.2.16, which fixes multiple CVEs.

The Micronaut Foundation is excited to announce the release of Micronaut framework 4.10.10! It contains releases of Micronaut Core, and Micronaut Test. Potential denial of service attacks fixes Today, we published two security advisories that are fixed in Micronaut Core 4.10.10. Thus, strongly recommend that every user update to the latest version of Micronaut. DoS...

The Micronaut® framework engineering team confirmed a security vulnerability in the management module, discovered by Joseph Beeton of Contrast Security, Inc. This vulnerability is assigned the identifier CVE-2024-23639. Summary A susceptible environment is where the application runs locally, management endpoints are enabled but unsecured, and the local host accesses an unrelated but problematic website. This...

The Micronaut team confirmed a security vulnerability found in the Micronaut Security Oauth2 dependency, identified and reported by Tommy Li. This vulnerability is assigned the identifier CVE-2023-36820. Summary When using a vulnerable version of micronaut-security-oauth2, the IdTokenClaimsValidator skips aud claim validation if the same authorization server issues the token. Affected Versions Micronaut Security versions greater...