CVE-2020-7611

CriticalCVSS 9.8/10Last modified Jun 17, 2026

Description

All versions of io.micronaut:micronaut-http-client before 1.2.11 and all versions from 1.3.0 before 1.3.2 are vulnerable to HTTP Request Header Injection due to not validating request headers passed to the client.

Metrics

CVSS 3.1 9.8/10CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Weakness enumeration

CWE-444

Affected software

No affected versions have been published.

Timeline

Published
Mar 30, 2020
Last modified
Jun 17, 2026
NVD status
Modified

Related CVEs from 2020

CVE-2020-76138.1clamscan through 1.2.0 is vulnerable to Command Injection. It is possible to inject arbitrary commands as part of the `_is_clamav_binary` fuCVE-2020-76149.8npm-programmatic through 0.0.12 is vulnerable to Command Injection.The packages and option properties are concatenated together without any CVE-2020-76157.8fsa through 0.5.1 is vulnerable to Command Injection. The first argument of 'execGitCommand()', located within 'lib/rep.js#63' can be controCVE-2020-76165.3express-mock-middleware through 0.0.6 is vulnerable to Prototype Pollution. Exported functions by the package can be tricked into adding or CVE-2020-76179.8ini-parser through 0.0.2 is vulnerable to Prototype Pollution.The library could be tricked into adding or modifying properties of Object.proCVE-2020-76185.3sds through 3.2.0 is vulnerable to Prototype Pollution.The library could be tricked into adding or modifying properties of the 'Object.protoCVE-2020-76199.8get-git-data through 1.3.1 is vulnerable to Command Injection. It is possible to inject arbitrary commands as part of the arguments providedCVE-2020-76209.8pomelo-monitor through 0.3.7 is vulnerable to Command Injection.It allows injection of arbitrary commands as part of 'pomelo-monitor' paramsCVE-2020-76219.8strong-nginx-controller through 1.0.2 is vulnerable to Command Injection. It allows execution of arbitrary command as part of the '_nginxCmdCVE-2020-76229.8This affects the package io.jooby:jooby-netty before 1.6.9, from 2.0.0 and before 2.2.1. The DefaultHttpHeaders is set to false which means CVE-2020-76239.8jscover through 1.0.0 is vulnerable to Command Injection. It allows execution of arbitrary command via the source argument.CVE-2020-76249.8effect through 1.0.4 is vulnerable to Command Injection. It allows execution of arbitrary command via the options argument.