CVE-2026-44242: Micronaut Framework memory exhaustion in ResourceBundleMessageSource

Executive brief

Micronaut is a framework used to build Java-based web applications. A vulnerability exists where applications configured to use specific message resources can be forced to consume excessive memory. An attacker can trigger this by sending many requests with different language preferences, potentially leading to service slowdowns or crashes due to memory exhaustion.

Technical details

The vulnerability is a denial-of-service (DoS) caused by uncontrolled resource consumption (CWE-400) in the ResourceBundleMessageSource component. The 'bundleCache' is implemented as an unbounded ConcurrentHashMap that stores ResourceBundle objects keyed by Locale. An attacker can send HTTP requests with unique 'Accept-Language' values to trigger HTML error responses, causing the application to populate the cache with new entries for every unique locale provided. This leads to gradual heap exhaustion. The issue affects applications that explicitly register a ResourceBundleMessageSource bean. Patches are available in versions 4.10.22, 3.10.6, and 3.8.14, which implement a bounded cache.

Affected products

• Micronaut micronaut-inject >= 4.10.0, < 4.10.22
• Micronaut micronaut-inject >= 3.10.0, < 3.10.6
• Micronaut micronaut-inject < 3.8.14

Timeline

• 2026-04-28: disclosed
• 2026-05-06: advisory
• 2026-05-06: patched
• 2026-05-12: kev added

References

• https://api.github.com/users/offset
• https://github.com/offset
• https://api.github.com/users/offset/gists%7B/gist_id%7D
• https://api.github.com/users/offset/repos
• https://avatars.githubusercontent.com/u/114768995?v=4
• https://api.github.com/users/offset/events%7B/privacy%7D