Vulnerability · Published May 12, 2026 · Assigned by GitHub_M
CVE-2026-44242Micronaut Framework: Unbounded bundleCache in ResourceBundleMessageSource Allows Memory Exhaustion via Accept-Language Header
Low 3.7
In plain English
A low-severity uncontrolled resource consumption in micronaut-core from micronaut-projects. Proof-of-concept exploit code is public. The chance it is exploited in the next 30 days is estimated at 0.3% (higher than 17% of all known vulnerabilities). Fixed versions are available - upgrade the affected package.
Official description
Micronaut Framework is a JVM-based full stack Java framework designed for building modular, easily testable JVM applications. Prior to 4.10.22, the bundleCache is keyed by (Locale, baseName) where the locale originates from the HTTP Accept-Language header. In applications that explicitly register a ResourceBundleMessageSource bean and serve HTML error responses, an unauthenticated attacker can exhaust heap memory by sending requests with large numbers of unique Accept-Language values, each causing a new entry in the unbounded bundleCache. This vulnerability is fixed in 4.10.22.
Affected packages & fixed versions
| Ecosystem | Package | Fixed in | Advisory |
|---|---|---|---|
| Maven | io.micronaut:micronaut-inject | 4.10.22 | GHSA-3rfq-4wpf-qqw3 |
| Maven | io.micronaut:micronaut-inject | 3.10.6 | GHSA-3rfq-4wpf-qqw3 |
| Maven | io.micronaut:micronaut-inject | 3.8.14 | GHSA-3rfq-4wpf-qqw3 |
Affected products (as reported)
| Vendor | Product | Versions |
|---|---|---|
| micronaut-projects | micronaut-core | < 4.10.22 |
Weakness: CWE-400 · Vector: CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:L