CVE-2026-44241highCWE-400

CVE-2026-44241: high-severity vulnerability in micronaut-projects micronaut-core

Micronaut Framework: Unbounded formattersCache in TimeConverterRegistrar Allows Memory Exhaustion via Accept-Language Header

Published · Updated

Follow this CVE+ Monitor micronaut-core+ Monitor io.micronaut:micronaut-context

E-mail alert when it lands in KEV, gets a public PoC or its score goes up.

21Vexday Risk Score

No sign of exploitation. No public exploitation artifact known so far.

ssvc Trackcvss 7.5epss 0.6%
Micronaut Framework is a JVM-based full stack Java framework designed for building modular, easily testable JVM applications. From 4.3.0 to before 4.10.22, 3.10.6, and 3.8.14, TimeConverterRegistrar caches DateTimeFormatter instances in an unbounded ConcurrentHashMap<String, DateTimeFormatter> whose key is derived from the @Format annotation pattern concatenated with the locale from the HTTP Accept-Language header. Because Locale.forLanguageTag() accepts arbitrary BCP 47 private-use extensions (en-x-a001, en-x-a002, …), an unauthenticated attacker can generate an unlimited number of unique cache keys by sending requests with novel locale tags, growing the cache until heap memory is exhausted and the JVM crashes. This vulnerability is fixed in 4.10.22, 3.10.6, and 3.8.14.
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Affected products
micronaut-projects · micronaut-core
Related CVEs — micronaut-projects micronaut-core

In the same product, most dangerous first.

CVE-2021-32769HIGHImproper Limitation of a Pathname to a Restricted Directory ('Path Traversal') in micronaut-coreEPSS 1.7%CVE-2022-21700MEDIUMMemory leak in micronaut-coreEPSS 1.2%CVE-2026-33013HIGHMicronaut vulnerable to DoS via crafted form-urlencoded body binding with descending array indicesEPSS 0.6%CVE-2026-33012HIGHMicronaut Framework vulnerable to a Denial of Service in HTML error response cachingEPSS 0.6%CVE-2024-23639MEDIUMmicronaut-core management endpoints vulnerable to drive-by localhost attackEPSS 0.3%CVE-2026-44242LOWMicronaut Framework: Unbounded bundleCache in ResourceBundleMessageSource Allows Memory Exhaustion via Accept-Language HeaderEPSS 0.3%