CVE-2026-33012: fallo de gravedad alta en micronaut-projects micronaut-core
Micronaut Framework vulnerable to a Denial of Service in HTML error response caching
Publicada el
Aviso por correo cuando entre en el KEV, tenga PoC pública o suba de nota.
21Vexday Risk Score
Sin señal de explotación. Ningún artefacto público de explotación conocido hasta ahora.
ssvc Trackcvss 7.5epss 0.6%
Micronaut Framework is a JVM-based full stack Java framework designed for building modular, easily testable JVM applications. Versions 4.7.0 through 4.10.16 used an unbounded ConcurrentHashMap cache with no eviction policy in its DefaultHtmlErrorResponseBodyProvider. If the application throws an exception whose message may be influenced by an attacker, (for example, including request query value parameters) it could be used by remote attackers to cause an unbounded heap growth and OutOfMemoryError, leading to DoS. This issue has been fixed in version 4.10.7.
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Productos afectados
micronaut-projects · micronaut-coreCVEs relacionadas — micronaut-projects micronaut-core
En el mismo producto, de las más peligrosas a las menos.
CVE-2021-32769HIGHImproper Limitation of a Pathname to a Restricted Directory ('Path Traversal') in micronaut-coreEPSS 1.7%CVE-2022-21700MEDIUMMemory leak in micronaut-coreEPSS 1.2%CVE-2026-44241HIGHMicronaut Framework: Unbounded formattersCache in TimeConverterRegistrar Allows Memory Exhaustion via Accept-Language HeaderEPSS 0.6%CVE-2026-33013HIGHMicronaut vulnerable to DoS via crafted form-urlencoded body binding with descending array indicesEPSS 0.6%CVE-2024-23639MEDIUMmicronaut-core management endpoints vulnerable to drive-by localhost attackEPSS 0.3%CVE-2026-44242LOWMicronaut Framework: Unbounded bundleCache in ResourceBundleMessageSource Allows Memory Exhaustion via Accept-Language HeaderEPSS 0.3%