CVE-2026-44241
1 advisory.
Maven/io.micronaut:micronaut-context CVE-2026-44241: high 7.5
Micronaut has unbounded `formattersCache` in `TimeConverterRegistrar` that Allows Memory Exhaustion via `Accept-Language` Header
Action: Upgrade io.micronaut:micronaut-context to 3.8.14 (3.8.x), 3.10.6 (3.10.x) or 4.10.22 (4.10.x) or later.
Affected
| introduced | fixed | last affected |
|---|---|---|
| 4.3.0 | 4.10.22 | - |
| 3.10.0 | 3.10.6 | - |
| 0 | 3.8.14 | - |
Fixed versions
| 4.10.22 | 3.10.6 | 3.8.14 |
Sources
- osv: GHSA-8hjv-92q9-g4xj
- https://github.com/micronaut-projects/micronaut-core/security/advisories/GHSA-8hjv-92q9-g4xj
- https://nvd.nist.gov/vuln/detail/CVE-2026-44241
- https://github.com/micronaut-projects/micronaut-core/commit/48f05ae8dc4157816fe0050c5cf730be7d44f8b3
- https://github.com/micronaut-projects/micronaut-core/commit/c2048ab740c2efdfe227813f203176e0ef93f892
- https://github.com/micronaut-projects/micronaut-core/commit/c6ca8782de7338732e887d090f38c9e941bcb284
- https://github.com/micronaut-projects/micronaut-core
- https://github.com/micronaut-projects/micronaut-core/releases/tag/v3.10.6
- https://github.com/micronaut-projects/micronaut-core/releases/tag/v3.8.14
- https://github.com/micronaut-projects/micronaut-core/releases/tag/v4.10.22
CVE-2026-44241 · published · modified · JSON