GitHub Advisoryadvisory · Maven

GHSA-2hcp-gjrf-7fhc Micronaut Framework vulnerable to a Denial of Service in HTML error response caching

HIGH Published 2026-03-17 Modified 2026-03-20 Official page ↗
Aliases
CVE-2026-33012
Ecosystem
Maven
Packages
io.micronaut:micronaut-http-server
Severity
High
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Weaknesses
CWE-770
Reviewed
2026-03-17

Affected packages

• Maven io.micronaut:micronaut-http-server: >= 4.7.0, < 4.10.17 → fixed in 4.10.17

Description

`DefaultHtmlErrorResponseBodyProvider` in `io.micronaut:micronaut-http-server` since `4.7.0` and until `4.10.7` used an unbounded `ConcurrentHashMap` cache with no eviction policy. If the application throws an exception whose message may be influenced by an attacker, for example, including request query value parameters, this could be used by remote attackers to cause a denial of service (unbounded heap growth and OutOfMemoryError). Fixed via: https://github.com/micronaut-projects/micronaut-core/commit/1e2ba2c14386af3d47751732d02053a72b0b49b3

Related

Alias · CVE (1)

  • CVE-2026-33012 Micronaut Framework is a JVM-based full stack Java framework designed for building modular, easily testable JVM applications. vulnerability

Weakness · CWE (1)

  • CWE-770 Allocation of Resources Without Limits or Throttling weakness

References