Heap Memory Exhaustion in Micronaut Framework by Unauthenticated Attacker

CVE-2026-44242

What is CVE-2026-44242?

The Micronaut Framework, a full stack Java framework, is susceptible to a heap memory exhaustion vulnerability caused by an improperly managed bundleCache. In versions prior to 4.10.22, the cache is indexed by (Locale, baseName) based on the HTTP Accept-Language header. If an application explicitly registers a ResourceBundleMessageSource bean to manage error responses, an unauthenticated attacker can exploit this flaw by sending an excessive amount of unique Accept-Language values. This leads to the creation of numerous cache entries without bounds, eventually consuming all available heap memory and causing service disruptions.

References