CVE-2026-44242

Low

Description

Micronaut Framework is a JVM-based full stack Java framework designed for building modular, easily testable JVM applications. Prior to 4.10.22, the bundleCache is keyed by (Locale, baseName) where the locale originates from the HTTP Accept-Language header. In applications that explicitly register a ResourceBundleMessageSource bean and serve HTML error responses, an unauthenticated attacker can exhaust heap memory by sending requests with large numbers of unique Accept-Language values, each causing a new entry in the unbounded bundleCache. This vulnerability is fixed in 4.10.22.

SeverityLow

CVSS3.7

Exploit probability—

ProductIo.micronaut:micronaut-inject

PublishedMay 12, 2026

First seenMay 12, 2026

Weakness typeCWE-400Uncontrolled resource consumption

How to fix

Update

io.micronaut:micronaut-inject4.10.22, 3.10.6, 3.8.14 or later

Affected products

Product	Affected versions	Fixed in
io.micronaut:micronaut-injectMaven	4.10.0 ≤ v < 4.10.22, 3.10.0 ≤ v < 3.10.6, v < 3.8.14	4.10.22, 3.10.6, 3.8.14

Check your version

Choose the product and enter the version you run to see whether it falls in the affected range.

In the Intelligence 360 plan

Attack Surface Management

See the assets tied to your domains, the technologies they run and known vulnerabilities in one list.