CVE-2026-44242: low-severity vulnerability in micronaut-projects micronaut-core
Micronaut Framework: Unbounded bundleCache in ResourceBundleMessageSource Allows Memory Exhaustion via Accept-Language Header
Published · Updated
E-mail alert when it lands in KEV, gets a public PoC or its score goes up.
8Vexday Risk Score
No sign of exploitation. No public exploitation artifact known so far.
ssvc Trackcvss 3.7epss 0.3%
Micronaut Framework is a JVM-based full stack Java framework designed for building modular, easily testable JVM applications. Prior to 4.10.22, the bundleCache is keyed by (Locale, baseName) where the locale originates from the HTTP Accept-Language header. In applications that explicitly register a ResourceBundleMessageSource bean and serve HTML error responses, an unauthenticated attacker can exhaust heap memory by sending requests with large numbers of unique Accept-Language values, each causing a new entry in the unbounded bundleCache. This vulnerability is fixed in 4.10.22.
CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:L
Affected products
micronaut-projects · micronaut-coreRelated CVEs — micronaut-projects micronaut-core
In the same product, most dangerous first.
CVE-2021-32769HIGHImproper Limitation of a Pathname to a Restricted Directory ('Path Traversal') in micronaut-coreEPSS 1.7%CVE-2022-21700MEDIUMMemory leak in micronaut-coreEPSS 1.2%CVE-2026-44241HIGHMicronaut Framework: Unbounded formattersCache in TimeConverterRegistrar Allows Memory Exhaustion via Accept-Language HeaderEPSS 0.6%CVE-2026-33013HIGHMicronaut vulnerable to DoS via crafted form-urlencoded body binding with descending array indicesEPSS 0.6%CVE-2026-33012HIGHMicronaut Framework vulnerable to a Denial of Service in HTML error response cachingEPSS 0.6%CVE-2024-23639MEDIUMmicronaut-core management endpoints vulnerable to drive-by localhost attackEPSS 0.3%