Micronaut Framework vulnerable to a Denial of Service in HTML error response caching
Key facts
- Attack vector
- Network
- Privileges required
- None
- User interaction
- None
- Attack complexity
- Low
- Impact type
- Denial of service
- Confidentiality · integrity · availability
- None · None · High
- Fix status
- Partial Red Hat: 4 without a fix
Attack profile from CVSS 3.1 · CNA. Fix status from CNA, GitHub and Red Hat. Impact type from CWE-770.
Summary
Micronaut Framework is a JVM-based full stack Java framework designed for building modular, easily testable JVM applications. Versions 4.7.0 through 4.10.16 used an unbounded ConcurrentHashMap cache with no eviction policy in its DefaultHtmlErrorResponseBodyProvider. If the application throws an exception whose message may be influenced by an attacker, (for example, including request query value parameters) it could be used by remote attackers to cause an unbounded heap growth and OutOfMemoryError, leading to DoS. This issue has been fixed in version 4.10.7.
Why it matters now
SSVC decision points
CISA ADP · SSVC 2.0.3
- Exploitation
- None
- Automatable
- Yes
- Technical impact
- Partial
The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.
Affected products
| Vendor | Product | Affected versions | Fixed in | Status | Source |
|---|---|---|---|---|---|
| micronaut-projects | micronaut-core | 4.7.0 to before 4.10.17 | 4.10.17 | Patch available | CNA |
| — | io.micronaut:micronaut-http-server (Maven) | 4.7.0 to before 4.10.17 | 4.10.17 | Patch available | GHSA-2hcp-gjrf-7fhc |
- micronaut-core Vendormicronaut-projects Affected 4.7.0 to before 4.10.17 Fixed in 4.10.17 Patch available CNA
- io.micronaut:micronaut-http-server (Maven) Vendor— Affected 4.7.0 to before 4.10.17 Fixed in 4.10.17 Patch available GHSA-2hcp-gjrf-7fhc
CPE configurations NVD · 1
| CPE | Versions | Role | Vendor |
|---|---|---|---|
| cpe:2.3:a:objectcomputing:micronaut:*:*:*:*:*:*:*:* | 4.7.0 to before 4.10.17 | Vulnerable | micronaut-projects |
- cpe:2.3:a:objectcomputing:micronaut:*:*:*:*:*:*:*:* Versions 4.7.0 to before 4.10.17 Vulnerable ·micronaut-projects
Remediation
- Fix · CNA micronaut-core (micronaut-projects) Fixed in 4.10.17
- Fix · GHSA-2hcp-gjrf-7fhc io.micronaut:micronaut-http-server (Maven) Fixed in 4.10.17 Advisory →
Vendor assessments
Red Hat
Red Hat rating: Moderate. Red Hat's page for this CVE →
| Product | Status | Plan or fix |
|---|---|---|
| Red Hat Fuse 7 | Affected | No fix yet: Fix deferred |
| Red Hat JBoss Enterprise Application Platform 8 | Affected | No fix yet: Fix deferred |
| Red Hat JBoss Enterprise Application Platform Expansion Pack | Affected | No fix yet: Fix deferred |
| Red Hat build of Apache Camel for Spring Boot 4 | Affected | No fix yet: Fix deferred |
Timeline
- 2026-10-02 Threatist record created from CVE-2026-33012
- 2026-10-03 Alias added: GHSA-2hcp-gjrf-7fhc
- 2026-10-25 EPSS moved to the below the 50th percentile
References
Patch 1
Advisory 2
More micronaut-projects Micronaut vulnerabilities
- TI-2026-25460 Micronaut vulnerable to DoS via crafted form-urlencoded body binding with descending array indices CVSS 4.0HIGH 8.2
- TI-2020-06133 All versions of io.micronaut:micronaut-http-client before 1.2.11 and all versions from… CVSS 3.1CRITICAL 9.8
- TI-2021-12436 Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') in micronaut-core CVSS 3.1HIGH 7.5
- TI-2024-15658 micronaut-core management endpoints vulnerable to drive-by localhost attack CVSS 3.1HIGH 7.8
- TI-2022-06076 Memory leak in micronaut-core CVSS 3.1MEDIUM 5.3
Sources
- CVE-2026-33012 · CVE Program
- CVE-2026-33012 · NVD
- FIRST EPSS
- GHSA-2hcp-gjrf-7fhc · GitHub Advisory Database · CC BY 4.0
- CVE-2026-33012 · Red Hat security data · CC BY 4.0
This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences