HIGH 7.5

GHSA-2hcp-gjrf-7fhc

Micronaut Framework vulnerable to a Denial of Service in HTML error response caching

상세

`DefaultHtmlErrorResponseBodyProvider` in `io.micronaut:micronaut-http-server` since `4.7.0` and until `4.10.7` used an unbounded `ConcurrentHashMap` cache with no eviction policy. If the application throws an exception whose message may be influenced by an attacker, for example, including request query value parameters, this could be used by remote attackers to cause a denial of service (unbounded heap growth and OutOfMemoryError).

Fixed via: https://github.com/micronaut-projects/micronaut-core/commit/1e2ba2c14386af3d47751732d02053a72b0b49b3

이 버전이 영향받나요?

사용 중인 패키지 버전을 입력하면 즉시 평가합니다.

영향 패키지

Maven / io.micronaut:micronaut-http-server

최초 영향 버전: 4.7.0 수정 버전: 4.10.17

수정 # pom.xml: bump <version>4.10.17</version> for io.micronaut:micronaut-http-server

참고

https://github.com/micronaut-projects/micronaut-core/security/advisories/GHSA-2hcp-gjrf-7fhc [WEB]
https://nvd.nist.gov/vuln/detail/CVE-2026-33012 [ADVISORY]
https://github.com/micronaut-projects/micronaut-core/commit/1e2ba2c14386af3d47751732d02053a72b0b49b3 [WEB]
https://github.com/micronaut-projects/micronaut-core [PACKAGE]
https://github.com/micronaut-projects/micronaut-core/releases/tag/v4.10.17 [WEB]