Micronaut Security Announcements

Micronaut Framework 5.2.5 is a security release that upgrades Netty to 4.2.20.Final. Matching security releases are also available for the Micronaut 4 and Micronaut 3 lines.

Micronaut Framework 5.2.4 is a security release. Its highlight is Micronaut Control Panel 2.2.1, which fixes two high-severity vulnerabilities. It also includes Micronaut Core 5.2.20 configuration fixes, Micronaut Data 5.2.4, Micronaut Serialization 3.2.6, Micronaut Object Storage 3.1.2 and Micronaut Sourcegen 2.2.4.

Micronaut Framework 5.2.3 is a security release with fixes in Micronaut Core and Security, plus updates to Data, Object Storage, and Serialization.

Micronaut Framework 3.10.15 is a security release. Micronaut Core 3.10.15 updates managed Netty to 4.1.139.Final, a Netty security release that fixes several vulnerabilities.

Micronaut Framework 4.10.21 is a security release. It includes Micronaut Core 4.10.31, which updates Jackson to 2.21.7 and Netty to 4.2.19.Final, both security releases that fix several vulnerabilities.

Micronaut Framework 5.2.2 is a security release. Its highlight is Micronaut Core 5.2.15 updating Netty to 4.2.19.Final, which fixes several vulnerabilities. It also includes Micronaut Data 5.2.2 and Micronaut Test Resources 4.3.1.

Micronaut framework 5.1.5 includes Micronaut Core 5.1.15, which updates Netty to 4.2.18.Final, a release containing several security fixes.

Micronaut framework 5.1.4 includes Micronaut Core 5.1.14 and Micronaut Data 5.1.4, which address several security advisories.

Micronaut framework 5.0.4 includes Micronaut Core and Netty 4.2.16, which fixes multiple CVEs.

We are excited to announce the release of Micronaut framework 4.10.10! It contains releases of Micronaut Core, and Micronaut Test. Potential denial of service attacks fixes Today, we published two security advisories that are fixed in Micronaut Core 4.10.10. Thus, strongly recommend that every user update to the latest version of Micronaut. DoS...

The Micronaut® framework engineering team confirmed a security vulnerability in the management module, discovered by Joseph Beeton of Contrast Security, Inc. This vulnerability is assigned the identifier CVE-2024-23639. Summary A susceptible environment is where the application runs locally, management endpoints are enabled but unsecured, and the local host accesses an unrelated but problematic website. This...

The Micronaut team confirmed a security vulnerability found in the Micronaut Security Oauth2 dependency, identified and reported by Tommy Li. This vulnerability is assigned the identifier CVE-2023-36820. Summary When using a vulnerable version of micronaut-security-oauth2, the IdTokenClaimsValidator skips aud claim validation if the same authorization server issues the token. Affected Versions Micronaut Security versions greater...