GHSA-2hcp-gjrf-7fhc
Micronaut Framework vulnerable to a Denial of Service in HTML error response caching
Quick fix
GHSA-2hcp-gjrf-7fhc — io.micronaut:micronaut-http-server: upgrade to the fixed version with the command below.
# pom.xml: bump <version>4.10.17</version> for io.micronaut:micronaut-http-serverDetails
`DefaultHtmlErrorResponseBodyProvider` in `io.micronaut:micronaut-http-server` since `4.7.0` and until `4.10.7` used an unbounded `ConcurrentHashMap` cache with no eviction policy. If the application throws an exception whose message may be influenced by an attacker, for example, including request query value parameters, this could be used by remote attackers to cause a denial of service (unbounded heap growth and OutOfMemoryError).
Fixed via: https://github.com/micronaut-projects/micronaut-core/commit/1e2ba2c14386af3d47751732d02053a72b0b49b3
Are you affected?
Enter the version of the package you're using.
Affected packages
4.7.0Fixed in: 4.10.17# pom.xml: bump <version>4.10.17</version> for io.micronaut:micronaut-http-serverReferences
- https://github.com/micronaut-projects/micronaut-core/security/advisories/GHSA-2hcp-gjrf-7fhc[WEB]
- https://nvd.nist.gov/vuln/detail/CVE-2026-33012[ADVISORY]
- https://github.com/micronaut-projects/micronaut-core/commit/1e2ba2c14386af3d47751732d02053a72b0b49b3[WEB]
- https://github.com/micronaut-projects/micronaut-core[PACKAGE]
- https://github.com/micronaut-projects/micronaut-core/releases/tag/v4.10.17[WEB]