Log in Start free

Vulnerability · Published May 12, 2026 · Assigned by GitHub_M

CVE-2026-44241Micronaut Framework: Unbounded formattersCache in TimeConverterRegistrar Allows Memory Exhaustion via Accept-Language Header

High 7.5

In plain English

A high-severity uncontrolled resource consumption in micronaut-core from micronaut-projects. Proof-of-concept exploit code is public. The chance it is exploited in the next 30 days is estimated at 0.6% (higher than 51% of all known vulnerabilities). Fixed versions are available - upgrade the affected package.

Severity (CVSS 3.1)7.5High
Exploit odds (30 days)0.6%top 49.3% of all CVEs
Exploited in the wildNo reportsCISA SSVC: poc
Attack toolingNoneno public tooling known

Official description

Micronaut Framework is a JVM-based full stack Java framework designed for building modular, easily testable JVM applications. From 4.3.0 to before 4.10.22, 3.10.6, and 3.8.14, TimeConverterRegistrar caches DateTimeFormatter instances in an unbounded ConcurrentHashMap<String, DateTimeFormatter> whose key is derived from the @Format annotation pattern concatenated with the locale from the HTTP Accept-Language header. Because Locale.forLanguageTag() accepts arbitrary BCP 47 private-use extensions (en-x-a001, en-x-a002, …), an unauthenticated attacker can generate an unlimited number of unique cache keys by sending requests with novel locale tags, growing the cache until heap memory is exhausted and the JVM crashes. This vulnerability is fixed in 4.10.22, 3.10.6, and 3.8.14.

Affected packages & fixed versions

EcosystemPackageFixed inAdvisory
Mavenio.micronaut:micronaut-context4.10.22GHSA-8hjv-92q9-g4xj
Mavenio.micronaut:micronaut-context3.10.6GHSA-8hjv-92q9-g4xj
Mavenio.micronaut:micronaut-context3.8.14GHSA-8hjv-92q9-g4xj

Affected products (as reported)

VendorProductVersions
micronaut-projects micronaut-core >= 4.3.0, < 4.10.22>= 3.10.0, < 3.10.6< 3.8.14

Weakness: CWE-400 · Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

References