Micronaut management endpoints vulnerable to drive-by localhost attack

Exploitation

No confirmed exploitation recorded. Patch Next marks exploitation only from CISA KEV.

CVSS

5.1 · CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:L

EPSS

• CVE-2024-23639: 0.26% estimated exploitation activity in the next 30 days; percentile 17.95 (FIRST EPSS, 2026-11-03). This is a model estimate, not proof of exploitation or customer exposure.

As published by the source; long descriptions are shortened.

Summary Enabled but unsecured management endpoints are susceptible to drive-by localhost attacks. While not typical of a production application, these attacks may have more impact on a development environment where such endpoints may be flipped on without much thought. Details A malicious/compromised website can make HTTP requests to localhost. Normally, such requests would trigger a CORS preflight check which would prevent the request; however, some requests are "simple" and do not require a preflight check. These endpoints, if enabled and not secured, are vulnerable to being triggered. Impact Production environments typically disable unused endpoints and secure/restrict access to needed endpoints. A more likely victim is the developer in their local development host, who has enabled endpoints without security for the sake of easing development.

Published by the source

9 Feb 2024, 15:19 UTC

Last modified by the source

9 Feb 2024, 15:19 UTC

Source last checked

26 Oct 2026, 16:26 UTC

1. Revision 1 · created · 26 Oct 2026

   Published from ghsa record GHSA-583g-g682-crxf

Preview the exact text before you copy it. Commands are read-only suggestions; review them before running anything.

# Patch Next advisory brief: CVE-2024-23639

Advisory: Micronaut management endpoints vulnerable to drive-by localhost attack
IDs: CVE-2024-23639, GHSA-583g-g682-crxf
Record: https://patchnext.com/advisories/cve-2024-23639 (revision 1, source checked 26 Oct 2026, 16:26 UTC)
Inventory: none attached. This brief comes from a public page and does not say whether any deployment is affected.
Severity: Medium (CVSS 5.1)
Exploitation: no confirmed exploitation recorded. Patch Next confirms exploitation only from CISA KEV.
Vendor response: Vendor fix available; fixed versions by package: io.micronaut:micronaut-http-server-tck 3.8.3; io.micronaut:micronaut-http-server 3.8.3; io.micronaut:micronaut-http-server-netty 3.8.3. A vendor fix does not mean a deployment is fixed.

## Affected components
- Maven io.micronaut:micronaut-http-server-tck: affected < 3.8.3; fixed in 3.8.3
- Maven io.micronaut:micronaut-http-server: affected < 3.8.3; fixed in 3.8.3
- Maven io.micronaut:micronaut-http-server-netty: affected < 3.8.3; fixed in 3.8.3

## Suggested inspection (read-only)
- Maven io.micronaut:micronaut-http-server-tck: check the installed version with your package manager.
- Maven io.micronaut:micronaut-http-server: check the installed version with your package manager.
- Maven io.micronaut:micronaut-http-server-netty: check the installed version with your package manager.

## Supported action
Upgrade each affected component to a fixed version on its release line. For a transitive dependency, upgrade the parent package or add an override or constraint, then regenerate the lockfile. Redeploy every environment that ran an affected version.

## Required regression checks
- Run the test suite and a production build.
- Exercise the features that depend on io.micronaut:micronaut-http-server-tck, io.micronaut:micronaut-http-server, io.micronaut:micronaut-http-server-netty.
- Repeat the inspection and confirm that only fixed versions remain installed.

## Rollback considerations
- Keep the previous lockfile and deployment artifact. Rolling back reinstates the vulnerable version, so apply any documented mitigation while you fix forward.

## Unresolved questions
- Which deployments run an affected version?
- Exploitation status can change. Check again before lowering the priority.
- Mark the work resolved only after the fixed version is verified in production.

## Sources
- Verified: https://github.com/advisories/GHSA-583g-g682-crxf (GitHub-reviewed advisory GHSA-583g-g682-crxf lists affected ranges: Maven io.micronaut:micronaut-http-server >=0 =0 =0 <3.8.3)

Commands are suggestions: review each one before running it.