Micronaut Framework is a JVM-based full stack Java framework designed for building modular, easily testable JVM applications. Prior to 4.10.22, the bundleCache is keyed by (Locale, baseName) where the locale originates from the HTTP Accept-Language header. In applications that explicitly register a ResourceBundleMessageSource bean and serve HTML error responses, an unauthenticated attacker can exhaust heap memory by sending requests with large numbers of unique Accept-Language values, each causing a new entry in the unbounded bundleCache. This vulnerability is fixed in 4.10.22.

There are packages installed that are affected by a vulnerability referenced in the following CVE:

  - Micronaut Framework is a JVM-based full stack Java framework designed for building modular, easily
    testable JVM applications. Prior to 4.10.22, the bundleCache is keyed by (Locale, baseName) where the
    locale originates from the HTTP Accept-Language header. In applications that explicitly register a
    ResourceBundleMessageSource bean and serve HTML error responses, an unauthenticated attacker can exhaust
    heap memory by sending requests with large numbers of unique Accept-Language values, each causing a new
    entry in the unbounded bundleCache. This vulnerability is fixed in 4.10.22. (CVE-2026-44242)

ID	Name	Product	Family	Type	Severity
457392	Echo: io.micronaut:micronaut-inject: security update to 3.8.14	Tenable Cloud Security	Echo Local Security Checks	Local	low
457392	Echo: io.micronaut:micronaut-inject: security update to 3.8.14	Tenable Self-Hosted Container Security	Echo Local Security Checks	Local	low
441365	SCA: security update for io.micronaut:micronaut-inject (GHSA-3rfq-4wpf-qqw3)	Tenable Cloud Security	SCA Checks	Local	low
441365	SCA: security update for io.micronaut:micronaut-inject (GHSA-3rfq-4wpf-qqw3)	Tenable Self-Hosted Container Security	SCA Checks	Local	low

Detections

Analytics

CVE-2026-44242

low

Tenable Plugins

low

low

low

low