{"cve":"CVE-2026-44241","nvd":{"published":"2026-05-12T22:16:35.473","modified":"2026-10-26T14:10:00.130","status":"Deferred","description":"Micronaut Framework is a JVM-based full stack Java framework designed for building modular, easily testable JVM applications. From 4.3.0 to before 4.10.22, 3.10.6, and 3.8.14, TimeConverterRegistrar caches DateTimeFormatter instances in an unbounded ConcurrentHashMap<String, DateTimeFormatter> whose key is derived from the @Format annotation pattern concatenated with the locale from the HTTP Accept-Language header. Because Locale.forLanguageTag() accepts arbitrary BCP 47 private-use extensions (en-x-a001, en-x-a002, …), an unauthenticated attacker can generate an unlimited number of unique cache keys by sending requests with novel locale tags, growing the cache until heap memory is exhausted and the JVM crashes. This vulnerability is fixed in 4.10.22, 3.10.6, and 3.8.14.","cvss_v4":null,"cvss_v3":{"version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","score":7.5},"cwes":["CWE-400"],"references":["https://github.com/micronaut-projects/micronaut-core/commit/48f05ae8dc4157816fe0050c5cf730be7d44f8b3","https://github.com/micronaut-projects/micronaut-core/commit/c2048ab740c2efdfe227813f203176e0ef93f892","https://github.com/micronaut-projects/micronaut-core/commit/c6ca8782de7338732e887d090f38c9e941bcb284","https://github.com/micronaut-projects/micronaut-core/releases/tag/v3.10.6","https://github.com/micronaut-projects/micronaut-core/releases/tag/v3.8.14"],"products":[],"source":"nvd","synced_at":"2026-10-26T14:27:29.784594657+00:00"},"epss":{"cve":"CVE-2026-44241","score":0.00543,"percentile":0.45373,"date":"2026-10-26"},"kev":null,"osv":[{"id":"GHSA-8hjv-92q9-g4xj","url":"https://osv.dev/vulnerability/GHSA-8hjv-92q9-g4xj","summary":"Micronaut has unbounded `formattersCache` in `TimeConverterRegistrar` that Allows Memory Exhaustion via `Accept-Language` Header","modified":"2026-07-10T00:15:09.355573702Z","packages":[{"ecosystem":"Maven","name":"io.micronaut:micronaut-context","purl":"pkg:maven/io.micronaut/micronaut-context","ranges":[">=4.3.0 <4.10.22"],"fixed":["4.10.22"]},{"ecosystem":"Maven","name":"io.micronaut:micronaut-context","purl":"pkg:maven/io.micronaut/micronaut-context","ranges":[">=3.10.0 <3.10.6"],"fixed":["3.10.6"]},{"ecosystem":"Maven","name":"io.micronaut:micronaut-context","purl":"pkg:maven/io.micronaut/micronaut-context","ranges":["<3.8.14"],"fixed":["3.8.14"]}]}],"attribution":["This product uses the NVD API but is not endorsed or certified by the NVD.","EPSS scores: FIRST Exploit Prediction Scoring System, https://www.first.org/epss","Known exploited vulnerabilities: CISA Known Exploited Vulnerabilities Catalog, https://www.cisa.gov/known-exploited-vulnerabilities-catalog","Package advisories: OSV (https://osv.dev), from the GitHub Advisory Database, PyPA, Go, RustSec and other ecosystem databases, under CC-BY 4.0 or CC0","CVE records: the CVE Program's CVE List (https://www.cve.org), under its terms of use (https://www.cve.org/Legal/TermsOfUse). CVE is a registered trademark of The MITRE Corporation; this product is not affiliated with the CVE Program."]}