CVE-2026-44242 Details
Description
Micronaut Framework is a JVM-based full stack Java framework designed for building modular, easily testable JVM applications. Prior to 4.10.22, the bundleCache is keyed by (Locale, baseName) where the locale originates from the HTTP Accept-Language header. In applications that explicitly register a ResourceBundleMessageSource bean and serve HTML error responses, an unauthenticated attacker can exhaust heap memory by sending requests with large numbers of unique Accept-Language values, each causing a new entry in the unbounded bundleCache. This vulnerability is fixed in 4.10.22.
A memory exhaustion vulnerability has been identified in the Micronaut Framework, specifically in versions prior to 4.10.22. The issue arises within the ResourceBundleMessageSource component, which manages localization resources for applications. The vulnerability allows an unauthenticated attacker to deplete heap memory by sending requests with numerous unique Accept-Language values. Each unique value creates a new entry in the unbounded bundleCache, leading to memory exhaustion. This issue primarily affects applications that explicitly register a ResourceBundleMessageSource bean and serve HTML error responses.
The vulnerability has been fixed in Micronaut Framework version 4.10.22. Users should upgrade to this version.
Metrics
CVSS 4.0 Severity and Vector Strings:
VolerionCVSS 3.x Severity and Vector Strings:
No data available for CVSS Version 2.0 on this CVE.
Volerion
Assessed May 12, 2026CISA-ADP
Assessed May 13, 2026References to Advisories, Solutions, and Tools
By selecting these links, you will be leaving this site. These are references gathered from the official CVE record and are not endorsed by Volerion.
| URL | Source(s) | Tag(s) |
|---|---|---|
| https://github.com/micronaut-projects/micronaut-core/security/advisories/GHSA-3rfq-4wpf-qqw3 | CISA-ADP | AdvisoryExploitRemedyVendor |
| https://github.com/micronaut-projects/micronaut-core/security/advisories/GHSA-3rfq-4wpf-qqw3 | [email protected] | AdvisoryExploitRemedyVendor |
Weakness Enumeration
| CWE-ID | CWE Name | Source |
|---|---|---|
| CWE-400 | Uncontrolled Resource Consumption | [email protected] |
Affected Products
| Product | Versions |
|---|---|
| Micronaut Framework | <= 5.0.0-SNAPSHOT (semver) |
CPE
Remediation
| |
Change History
4 change records found show changes
| Date | Action | Recorded By |
|---|---|---|
| Jun 17, 2026 | CVE Modified | [email protected] |
| Jun 17, 2026 | CVE Modified | CISA-ADP |
| May 13, 2026 | CVE Modified | CISA-ADP |
| May 12, 2026 | New CVE Received | [email protected] |