CVE-2020-7611: 
Java vulnerability analysis and mitigation

The vulnerability CVE-2020-7611 affects Micronaut's HTTP client, specifically versions before 1.2.11 and versions 1.3.0 before 1.3.2. This security flaw is related to HTTP Request Header Injection, which occurs due to the client not validating request headers passed to it. The vulnerability was discovered and disclosed on March 26, 2020 (GitHub Advisory).

The vulnerability is classified as CWE-113 (Improper Neutralization of CRLF Sequences in HTTP Headers). The issue allows attackers to manipulate request headers and body when user input is directly passed as header values to the HTTP client. The CVSS score is rated as 5.6 (medium) by Snyk, with network attack vector, high attack complexity, and no privileges required for exploitation (Snyk Report).

When exploited, this vulnerability enables attackers to perform a variant of Server Side Request Forgery (SSRF). The attacker can gain control over the entirety of the HTTP body for their custom requests, potentially leading to unauthorized data access or system manipulation (GitHub Advisory).

The vulnerability has been patched in micronaut-http-client versions 1.2.11 and 1.3.2 and above. For those unable to upgrade immediately, the recommended workaround is to avoid passing user data directly received from HTTP request parameters as headers in the HTTP client (GitHub Advisory).