Micronaut Framework is a JVM-based full stack Java framework designed for building modular, easily testable JVM applications. From 4.3.0 to before 4.10.22, 3.10.6, and 3.8.14, TimeConverterRegistrar caches DateTimeFormatter instances in an unbounded ConcurrentHashMap<String, DateTimeFormatter> whose key is derived from the @Format annotation pattern concatenated with the locale from the HTTP Accept-Language header. Because Locale.forLanguageTag() accepts arbitrary BCP 47 private-use extensions (en-x-a001, en-x-a002, …), an unauthenticated attacker can generate an unlimited number of unique cache keys by sending requests with novel locale tags, growing the cache until heap memory is exhausted and the JVM crashes. This vulnerability is fixed in 4.10.22, 3.10.6, and 3.8.14.

There are packages installed that are affected by a vulnerability referenced in the following CVE:

  - Micronaut Framework is a JVM-based full stack Java framework designed for building modular, easily
    testable JVM applications. From 4.3.0 to before 4.10.22, 3.10.6, and 3.8.14, TimeConverterRegistrar caches
    DateTimeFormatter instances in an unbounded ConcurrentHashMap<String, DateTimeFormatter> whose key is
    derived from the @Format annotation pattern concatenated with the locale from the HTTP Accept-Language
    header. Because Locale.forLanguageTag() accepts arbitrary BCP 47 private-use extensions (en-x-a001, en-
    x-a002, …), an unauthenticated attacker can generate an unlimited number of unique cache keys by sending
    requests with novel locale tags, growing the cache until heap memory is exhausted and the JVM crashes.
    This vulnerability is fixed in 4.10.22, 3.10.6, and 3.8.14. (CVE-2026-44241)

ID	Name	Product	Family	Type	Severity
457557	Echo: io.micronaut:micronaut-context: security update to 3.8.14	Tenable Cloud Security	Echo Local Security Checks	Local	high
457557	Echo: io.micronaut:micronaut-context: security update to 3.8.14	Tenable Self-Hosted Container Security	Echo Local Security Checks	Local	high
441363	SCA: security update for io.micronaut:micronaut-context (GHSA-8hjv-92q9-g4xj)	Tenable Cloud Security	SCA Checks	Local	high
441363	SCA: security update for io.micronaut:micronaut-context (GHSA-8hjv-92q9-g4xj)	Tenable Self-Hosted Container Security	SCA Checks	Local	high

Detections

Analytics

CVE-2026-44241

high

Tenable Plugins

high

high

high

high