Uncontrolled resource consumption in micronaut-projects micronaut-core
Key facts
- Attack vector
- Network
- Privileges required
- None
- User interaction
- None
- Attack complexity
- Low
- Impact type
- Denial of service
- Confidentiality · integrity · availability
- None · None · High
- Fix status
- Fixed
Attack profile from CVSS 3.1 · CNA. Fix status from CNA and GitHub. Impact type from CWE-400.
Summary
Micronaut Framework is a JVM-based full stack Java framework designed for building modular, easily testable JVM applications. From 4.3.0 to before 4.10.22, 3.10.6, and 3.8.14, TimeConverterRegistrar caches DateTimeFormatter instances in an unbounded ConcurrentHashMap<String, DateTimeFormatter> whose key is derived from the @Format annotation pattern concatenated with the locale from the HTTP Accept-Language header. Because Locale.forLanguageTag() accepts arbitrary BCP 47 private-use extensions (en-x-a001, en-x-a002, …), an unauthenticated attacker can generate an unlimited number of unique cache keys by sending requests with novel locale tags, growing the cache until heap memory is exhausted and the JVM crashes. This vulnerability is fixed in 4.10.22, 3.10.6, and 3.8.14.
Why it matters now
SSVC decision points
CISA ADP · SSVC 2.0.3
- Exploitation
- Poc
- Automatable
- Yes
- Technical impact
- Partial
The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.
Affected products
| Vendor | Product | Affected versions | Fixed in | Status | Source |
|---|---|---|---|---|---|
| micronaut-projects | micronaut-core | 4.3.0 to before 4.10.22; 3.10.0 to before 3.10.6; before 3.8.14 | 4.10.22, 3.10.6, 3.8.14 | Patch available | CNA |
| — | io.micronaut:micronaut-context (Maven) | 4.3.0 to before 4.10.22 | 4.10.22 | Patch available | GHSA-8hjv-92q9-g4xj |
| — | io.micronaut:micronaut-context (Maven) | 3.10.0 to before 3.10.6 | 3.10.6 | Patch available | GHSA-8hjv-92q9-g4xj |
| — | io.micronaut:micronaut-context (Maven) | before 3.8.14 | 3.8.14 | Patch available | GHSA-8hjv-92q9-g4xj |
- micronaut-core Vendormicronaut-projects Affected 4.3.0 to before 4.10.22; 3.10.0 to before 3.10.6; before 3.8.14 Fixed in 4.10.22, 3.10.6, 3.8.14 Patch available CNA
- io.micronaut:micronaut-context (Maven) Vendor— Affected 4.3.0 to before 4.10.22 Fixed in 4.10.22 Patch available GHSA-8hjv-92q9-g4xj
- io.micronaut:micronaut-context (Maven) Vendor— Affected 3.10.0 to before 3.10.6 Fixed in 3.10.6 Patch available GHSA-8hjv-92q9-g4xj
- io.micronaut:micronaut-context (Maven) Vendor— Affected before 3.8.14 Fixed in 3.8.14 Patch available GHSA-8hjv-92q9-g4xj
CPE names Threatist (inferred) · 1
Inferred from how NVD named this product before; not given by a source.
| CPE | Versions | Role | Vendor |
|---|---|---|---|
| cpe:2.3:a:objectcomputing:micronaut:*:*:*:*:*:*:*:* | — | — | micronaut-projects |
- cpe:2.3:a:objectcomputing:micronaut:*:*:*:*:*:*:*:* Versions — — ·micronaut-projects
Remediation
- Fix · CNA micronaut-core (micronaut-projects) Fixed in 4.10.22, 3.10.6, 3.8.14
- Fix · GHSA-8hjv-92q9-g4xj io.micronaut:micronaut-context (Maven) Fixed in 4.10.22 Advisory →
- Fix · GHSA-8hjv-92q9-g4xj io.micronaut:micronaut-context (Maven) Fixed in 3.10.6 Advisory →
- Fix · GHSA-8hjv-92q9-g4xj io.micronaut:micronaut-context (Maven) Fixed in 3.8.14 Advisory →
Timeline
- 2026-10-02 Threatist record created from CVE-2026-44241
- 2026-10-03 Alias added: GHSA-8hjv-92q9-g4xj
- 2026-10-25 EPSS moved to the below the 50th percentile
- 2026-10-27 EPSS moved to the 50th–90th percentile
References
Other 8
- https://github.com/micronaut-projects/micronaut-core/security/advisories/GHSA-8hjv-92q9-g4xj
- https://github.com/micronaut-projects/micronaut-core/commit/48f05ae8dc4157816fe0050c5cf730be7d44f8b3
- https://github.com/micronaut-projects/micronaut-core/commit/c2048ab740c2efdfe227813f203176e0ef93f892
- https://github.com/micronaut-projects/micronaut-core/commit/c6ca8782de7338732e887d090f38c9e941bcb284
- https://github.com/micronaut-projects/micronaut-core/releases/tag/v3.10.6
- https://github.com/micronaut-projects/micronaut-core/releases/tag/v3.8.14
- https://github.com/micronaut-projects/micronaut-core/releases/tag/v4.10.22
- https://github.com/micronaut-projects/micronaut-core
More micronaut-projects vulnerabilities
- TI-2026-25460 Micronaut vulnerable to DoS via crafted form-urlencoded body binding with descending array indices CVSS 4.0HIGH 8.2
- TI-2025-41133 An integer overflow in the RTPS protocol implementation of OpenDDS DDS before v3.33.0… CVSS 3.1HIGH 7.5
- TI-2023-19348 Malformed PID_PROPERTY_LIST parameter in DATA submessage remotely crashes OpenDDS CVSS 3.1HIGH 7.5
- TI-2023-18614 micronaut security has invalid IdTokenClaimsValidator logic on aud CVSS 3.1MEDIUM 6.5
- TI-2024-20388 An issue was discovered in OpenDDS commit b1c534032bb62ad4ae32609778de6b8d6c823a66… CVSS 3.1MEDIUM 4.3
- TI-2026-32219 Uncontrolled resource consumption in micronaut-projects micronaut-core CVSS 3.1LOW 3.7
Sources
- CVE-2026-44241 · CVE Program
- CVE-2026-44241 · NVD
- FIRST EPSS
- GHSA-8hjv-92q9-g4xj · GitHub Advisory Database · CC BY 4.0
This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences