CVE-2026-44242lowCWE-400

CVE-2026-44242: fallo de gravedad baja en micronaut-projects micronaut-core

Micronaut Framework: Unbounded bundleCache in ResourceBundleMessageSource Allows Memory Exhaustion via Accept-Language Header

Publicada el · Actualizada el

Seguir esta CVE+ Monitorear micronaut-core+ Monitorear io.micronaut:micronaut-inject

Aviso por correo cuando entre en el KEV, tenga PoC pública o suba de nota.

8Vexday Risk Score

Sin señal de explotación. Ningún artefacto público de explotación conocido hasta ahora.

ssvc Trackcvss 3.7epss 0.3%
Micronaut Framework is a JVM-based full stack Java framework designed for building modular, easily testable JVM applications. Prior to 4.10.22, the bundleCache is keyed by (Locale, baseName) where the locale originates from the HTTP Accept-Language header. In applications that explicitly register a ResourceBundleMessageSource bean and serve HTML error responses, an unauthenticated attacker can exhaust heap memory by sending requests with large numbers of unique Accept-Language values, each causing a new entry in the unbounded bundleCache. This vulnerability is fixed in 4.10.22.
CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:L
Productos afectados
micronaut-projects · micronaut-core
CVEs relacionadas — micronaut-projects micronaut-core

En el mismo producto, de las más peligrosas a las menos.

CVE-2021-32769HIGHImproper Limitation of a Pathname to a Restricted Directory ('Path Traversal') in micronaut-coreEPSS 1.7%CVE-2022-21700MEDIUMMemory leak in micronaut-coreEPSS 1.2%CVE-2026-44241HIGHMicronaut Framework: Unbounded formattersCache in TimeConverterRegistrar Allows Memory Exhaustion via Accept-Language HeaderEPSS 0.6%CVE-2026-33013HIGHMicronaut vulnerable to DoS via crafted form-urlencoded body binding with descending array indicesEPSS 0.6%CVE-2026-33012HIGHMicronaut Framework vulnerable to a Denial of Service in HTML error response cachingEPSS 0.6%CVE-2024-23639MEDIUMmicronaut-core management endpoints vulnerable to drive-by localhost attackEPSS 0.3%