CVE-2026-44242

LowCVSS 3.7

Published: 12/05/2026(UTC)Updated: 26/10/2026(UTC)Translated: 26/10/2026(UTC)NVD NIST

Exploitation Probability (EPSS)

Low risk

0.21%

11th percentile - higher than 11% of all known CVEs

Summary

In Micronaut Framework prior to 4.10.22, the bundleCache is keyed by (Locale, baseName), where the locale originates from the HTTP Accept-Language header. In applications that explicitly register a ResourceBundleMessageSource bean and serve HTML error responses, an unauthenticated attacker can exhaust heap memory by sending requests with many unique Accept-Language values, each creating a new entry in the unbounded bundleCache.

Risk Assessment

An unauthenticated attacker can cause memory exhaustion and denial of service (DoS) by flooding the application with requests carrying unique Accept-Language values.

Recommendation

Upgrade Micronaut Framework to version 4.10.22. Consider bounding the bundleCache size or validating the Accept-Language header as defense in depth.

Other vulnerabilities in Micronaut Framework

CVE-2026-44241High
A vulnerability in the Micronaut Framework allows an unauthenticated attacker to exhaust heap memory by sending requests with unique locale tags in the Accept-Language header. The DateTimeFormatter caching mechanism in TimeConverterRegistrar uses an unbounded ConcurrentHashMap whose key includes the locale from the HTTP header, enabling an unlimited number of cache entries.

Original NVD description (English source)

Micronaut Framework is a JVM-based full stack Java framework designed for building modular, easily testable JVM applications. Prior to 4.10.22, the bundleCache is keyed by (Locale, baseName) where the locale originates from the HTTP Accept-Language header. In applications that explicitly register a ResourceBundleMessageSource bean and serve HTML error responses, an unauthenticated attacker can exhaust heap memory by sending requests with large numbers of unique Accept-Language values, each causing a new entry in the unbounded bundleCache. This vulnerability is fixed in 4.10.22.

Vulnerability data from NVD (NIST) · CISA KEV · EPSS