Junglewise Threat Intelligence

CVE-2026-44241: Micronaut Framework denial of service via unbounded cache in TimeConverterRegistrar

CVE-2026-44241 · Severity: high · CVSS 7.5 · Published 2026-05-12

Vendors: Maven.

Executive brief

The Micronaut Framework, a popular tool for building Java-based web applications, contains a flaw that allows an attacker to crash a server remotely. By sending a large number of specially crafted web requests with unique language settings, an attacker can force the server to consume all available memory. This leads to a denial-of-service condition, making the application unavailable to legitimate users.

Technical details

The vulnerability is a resource exhaustion issue (CWE-400) within the `TimeConverterRegistrar` component of Micronaut Core. The component uses an unbounded `ConcurrentHashMap` to cache `DateTimeFormatter` instances, using a key derived from the `@Format` annotation and the `Accept-Language` HTTP header. Because `Locale.forLanguageTag()` in Java accepts arbitrary BCP 47 private-use extensions, an unauthenticated remote attacker can provide an infinite variety of unique locale tags. Each unique tag results in a new entry in the cache, eventually leading to heap exhaustion and a JVM crash. This issue is structurally similar to a previous vulnerability in `DefaultHtmlErrorResponseBodyProvider` but was missed in earlier remediation efforts. The fix involves bounding the cache size.

Affected products

  • micronaut-projects micronaut-core >= 4.3.0, < 4.10.22; >= 3.10.0, < 3.10.6; < 3.8.14

Timeline

  • 2026-04-28: patched: Fixes released in versions 4.10.22, 3.10.6, and 3.8.14
  • 2026-05-12: disclosed: Initial advisory publication

References

Related threats