PT-2026-25991 · Maven · Io.Micronaut:Micronaut-Http-Server

Published 2026-03-17 · Updated 2026-03-17 · CVE-2026-33012

OSV

CVSS v3.1

7.5

7.5

High

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

DefaultHtmlErrorResponseBodyProvider in io.micronaut:micronaut-http-server since 4.7.0 and until 4.10.7 used an unbounded ConcurrentHashMap cache with no eviction policy. If the application throws an exception whose message may be influenced by an attacker, for example, including request query value parameters, this could be used by remote attackers to cause a denial of service (unbounded heap growth and OutOfMemoryError).

Fixed via: https://github.com/micronaut-projects/micronaut-core/commit/1e2ba2c14386af3d47751732d02053a72b0b49b3

Fix

Allocation of Resources Without Limits

Weakness Enumeration

CWE-770

Related Identifiers

CVE-2026-33012

GHSA-2HCP-GJRF-7FHC

Affected Products

Io.Micronaut:Micronaut-Http-Server

References · 5

• https://osv.dev/vulnerability/GHSA-2hcp-gjrf-7fhc · Vendor Advisory
• https://github.com/micronaut-projects/micronaut-core · Note
• https://github.com/micronaut-projects/micronaut-core/releases/tag/v4.10.17 · Note
• https://github.com/micronaut-projects/micronaut-core/security/advisories/GHSA-2hcp-gjrf-7fhc · Note
• https://github.com/micronaut-projects/micronaut-core/commit/1e2ba2c14386af3d47751732d02053a72b0b49b3 · Note