PT-2026-25991 · Micronaut · Micronaut-Http-Server+1

Shblue21

·

Published

2026-03-17

·

Updated

2026-03-22

·

CVE-2026-33012

CVSS v3.1

7.5

High

VectorAV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Name of the Vulnerable Software and Affected Versions Micronaut Framework versions 4.7.0 through 4.10.16
Description The Micronaut Framework, a JVM-based full stack Java framework, is affected by a denial-of-service issue. The DefaultHtmlErrorResponseBodyProvider component used an unbounded ConcurrentHashMap cache without an eviction policy. If an application throws an exception with a message influenced by an attacker – for example, through request query parameters – this could lead to uncontrolled heap growth and an OutOfMemoryError, resulting in a denial of service. The vulnerable component is DefaultHtmlErrorResponseBodyProvider within io.micronaut:micronaut-http-server. The vulnerable parameter is the exception message, which can be influenced by attacker-controlled input.
Recommendations Versions prior to 4.10.7 are vulnerable. Update to version 4.10.7 or later to resolve the issue.

Exploit

Fix

DoS

Allocation of Resources Without Limits

Weakness Enumeration

CWE-770

Related Identifiers

CVE-2026-33012
GHSA-2HCP-GJRF-7FHC

Affected Products

Micronaut Framework
Micronaut-Http-Server