CVE Explorer
CVE-2026-44242
Micronaut Framework is a JVM-based full stack Java framework designed for building modular, easily testable JVM applications. Prior to 4.10.22, the bundleCache is keyed by (Locale, baseName) where the locale originates from the HTTP Accept-Language header. In applications that explicitly register a ResourceBundleMessageSource bean and serve HTML error responses, an unauthenticated attacker can exhaust heap memory by sending requests with large numbers of unique Accept-Language values, each causi
Known exploited
Not asserted
Disputed
No
Stale source
No
Conflicts
0
Affected products and versions
1 source assertion{"product":"micronaut-core","vendor":"micronaut-projects","versions":[{"status":"affected","version":"< 4.10.22"}]}
- cve_program_cvelist_v5affectedurn:baitaphish:normalized-source-record:v2:4ce3422bad0c6b7315178b38b7388c097c7ef816b8da56073b99b5fde7836981 · sha256:1ae6fad92d73161b… · /containers/cna/affected/0
Provider-owned CVSS observations
1 source assertion{"metric":{"attackComplexity":"HIGH","attackVector":"NETWORK","availabilityImpact":"LOW","baseScore":3.7,"baseSeverity":"LOW","confidentialityImpact":"NONE","integrityImpact":"NONE","privilegesRequired":"NONE","scope":"UNCHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:L","version":"3.1"},"metric_type":"cvssV3_1"}
- cve_program_cvelist_v5cvssurn:baitaphish:normalized-source-record:v2:4ce3422bad0c6b7315178b38b7388c097c7ef816b8da56073b99b5fde7836981 · sha256:1ae6fad92d73161b… · /containers/cna/metrics/0/cvssV3_1
CWE assertions
1 source assertion{"cweId":"CWE-400","description":"CWE-400: Uncontrolled Resource Consumption","lang":"en","type":"CWE"}
- cve_program_cvelist_v5cweurn:baitaphish:normalized-source-record:v2:4ce3422bad0c6b7315178b38b7388c097c7ef816b8da56073b99b5fde7836981 · sha256:1ae6fad92d73161b… · /containers/cna/problemTypes/0/descriptions/0
Source references
2 source assertions{"name":"https://github.com/micronaut-projects/micronaut-core/security/advisories/GHSA-3rfq-4wpf-qqw3","tags":["x_refsource_CONFIRM"],"url":"https://github.com/micronaut-projects/micronaut-core/security/advisories/GHSA-3rfq-4wpf-qqw3"}
- cve_program_cvelist_v5referenceurn:baitaphish:normalized-source-record:v2:4ce3422bad0c6b7315178b38b7388c097c7ef816b8da56073b99b5fde7836981 · sha256:1ae6fad92d73161b… · /containers/cna/references/0
{"tags":["exploit"],"url":"https://github.com/micronaut-projects/micronaut-core/security/advisories/GHSA-3rfq-4wpf-qqw3"}
- cve_program_cvelist_v5referenceurn:baitaphish:normalized-source-record:v2:4ce3422bad0c6b7315178b38b7388c097c7ef816b8da56073b99b5fde7836981 · sha256:1ae6fad92d73161b… · /containers/adp/0/references/0
Attribution and limitations
- CVE Program CVEList V5: Reproduce the MITRE copyright designation and CVE license in copies. Source →
Provider severity values are preserved separately. Baitaphish does not convert them into a risk rating, infer affected products, or treat EPSS as observed exploitation.