Micronaut Framework DoS Vulnerability (CVE-2026-44241) Risks Heap Exhaustion

The Micronaut Framework, a JVM-based full-stack Java framework, is susceptible to a denial-of-service (DoS) vulnerability tracked as CVE-2026-44241. According to the National Vulnerability Database, versions 4.3.0 through to 4.10.21 are affected. The flaw lies within the TimeConverterRegistrar, which caches DateTimeFormatter instances using an unbounded ConcurrentHashMap.

This cache’s key is derived from the @Format annotation pattern combined with the locale from the HTTP Accept-Language header. The National Vulnerability Database highlights that Locale.forLanguageTag() accepts arbitrary BCP 47 private-use extensions (e.g., en-x-a001). An unauthenticated attacker can exploit this by sending requests with novel locale tags, generating an unlimited number of unique cache keys. This rapidly expands the cache, ultimately exhausting heap memory and crashing the JVM.

With a CVSS score of 7.5 (HIGH), this unauthenticated DoS vulnerability presents a significant operational risk. Defenders must recognize that the attacker’s calculus here is straightforward: send specially crafted requests, induce memory exhaustion, and take the application offline. It’s a low-effort, high-impact attack that requires immediate mitigation.