PT-2026-38293 · Unknown · Micronaut Framework

Published 2026-05-06 · Updated 2026-05-13 · CVE-2026-44242

Positive Technologies (AI Summary)

CVSS v3.1

3.7

Low

Base vector

AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:L

Name of the Vulnerable Software and Affected Versions Micronaut Framework versions prior to 4.10.22

Description In applications that explicitly register a ResourceBundleMessageSource bean and serve HTML error responses, an unauthenticated attacker can cause heap memory exhaustion. This occurs because the bundleCache is unbounded and keyed by a combination of Locale and baseName, where the locale is derived from the HTTP Accept-Language header. By sending a large number of requests with unique Accept-Language values, an attacker can force the application to create an excessive number of entries in the bundleCache, leading to memory depletion.

Recommendations Update to version 4.10.22.

Exploit

Fix

DoS

Resource Exhaustion

Weakness Enumeration

CWE-400

Related Identifiers

CVE-2026-44242

GHSA-3RFQ-4WPF-QQW3

Affected Products

Micronaut Framework

References · 8

• 🔥 https://github.com/micronaut-projects/micronaut-core/security/advisories/GHSA-3rfq-4wpf-qqw3 · Exploit
• https://osv.dev/vulnerability/GHSA-3rfq-4wpf-qqw3 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2026-44242 · Security Note
• https://github.com/micronaut-projects/micronaut-core · Note
• https://github.com/micronaut-projects/micronaut-core/releases/tag/v4.10.22 · Note
• https://twitter.com/VulmonFeeds/status/2054453175583674731 · Twitter Post
• https://t.me/CVEtracker/53552 · Telegram Post
• https://twitter.com/CVEnew/status/2054323986901991476 · Twitter Post