Unbounded Heap Growth Vulnerability in Micronaut Framework

CVE-2026-33012

What is CVE-2026-33012?

The Micronaut Framework versions 4.7.0 through 4.10.16 have a vulnerability in their DefaultHtmlErrorResponseBodyProvider, resulting from the use of an unbounded ConcurrentHashMap cache without an eviction policy. When exceptions with messages influenced by user input occur, this problem can lead to unbounded heap growth and potential OutOfMemoryError. This vulnerability can be exploited by remote attackers to cause a denial of service to the application. Users are advised to update to version 4.10.7 or newer to mitigate this risk.

References