CVE-2026-33012
Description
Micronaut Framework is a JVM-based full stack Java framework designed for building modular, easily testable JVM applications. Versions 4.7.0 through 4.10.16 used an unbounded ConcurrentHashMap cache with no eviction policy in its DefaultHtmlErrorResponseBodyProvider. If the application throws an exception whose message may be influenced by an attacker, (for example, including request query value parameters) it could be used by remote attackers to cause an unbounded heap growth and OutOfMemoryError, leading to DoS. This issue has been fixed in version 4.10.7.
How to fix
- objectcomputing micronaut4.10.17 or later
- io.micronaut:micronaut-http-server4.10.17 or later
Affected products
| Product | Affected versions | Fixed in |
|---|---|---|
| objectcomputing micronaut | 4.7.0 ≤ v < 4.10.17 | 4.10.17 |
| io.micronaut:micronaut-http-serverMaven | 4.7.0 ≤ v < 4.10.17 | 4.10.17 |
Check your version
Choose the product and enter the version you run to see whether it falls in the affected range.
Attack Surface Management
See the assets tied to your domains, the technologies they run and known vulnerabilities in one list.