{"id":"GHSA-2hcp-gjrf-7fhc","summary":"Micronaut Framework vulnerable to a Denial of Service in HTML error response caching","details":"`DefaultHtmlErrorResponseBodyProvider` in `io.micronaut:micronaut-http-server` since `4.7.0` and until `4.10.7` used an unbounded `ConcurrentHashMap` cache with no eviction policy. If the application throws an exception whose message may be influenced by an attacker, for example, including request query value parameters,  this could be used by remote attackers\nto cause a denial of service (unbounded heap growth and OutOfMemoryError). \n\nFixed via: https://github.com/micronaut-projects/micronaut-core/commit/1e2ba2c14386af3d47751732d02053a72b0b49b3","aliases":["CVE-2026-33012"],"modified":"2026-09-10T03:50:36.483039311Z","published":"2026-03-17T18:39:27Z","database_specific":{"cwe_ids":["CWE-770"],"severity":"HIGH","github_reviewed":true,"github_reviewed_at":"2026-03-17T18:39:27Z","nvd_published_at":"2026-03-20T05:16:15Z"},"references":[{"type":"WEB","url":"https://github.com/micronaut-projects/micronaut-core/security/advisories/GHSA-2hcp-gjrf-7fhc"},{"type":"ADVISORY","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-33012"},{"type":"WEB","url":"https://github.com/micronaut-projects/micronaut-core/commit/1e2ba2c14386af3d47751732d02053a72b0b49b3"},{"type":"PACKAGE","url":"https://github.com/micronaut-projects/micronaut-core"},{"type":"WEB","url":"https://github.com/micronaut-projects/micronaut-core/releases/tag/v4.10.17"}],"affected":[{"package":{"name":"io.micronaut:micronaut-http-server","ecosystem":"Maven","purl":"pkg:maven/io.micronaut/micronaut-http-server"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"4.7.0"},{"fixed":"4.10.17"}]}],"versions":["4.10.0","4.10.1","4.10.10","4.10.11","4.10.12","4.10.13","4.10.14","4.10.15","4.10.16","4.10.2","4.10.3","4.10.4","4.10.5","4.10.6","4.10.7","4.10.8","4.10.9","4.7.0","4.7.1","4.7.10","4.7.11","4.7.12","4.7.13","4.7.14","4.7.15","4.7.16","4.7.17","4.7.18","4.7.19","4.7.2","4.7.20","4.7.21","4.7.22","4.7.23","4.7.24","4.7.25","4.7.26","4.7.27","4.7.3","4.7.4","4.7.5","4.7.6","4.7.7","4.7.8","4.7.9","4.8.0","4.8.1","4.8.10","4.8.11","4.8.12","4.8.13","4.8.14","4.8.15","4.8.16","4.8.17","4.8.18","4.8.19","4.8.2","4.8.3","4.8.4","4.8.5","4.8.6","4.8.7","4.8.8","4.8.9","4.9.0","4.9.1","4.9.10","4.9.11","4.9.12","4.9.2","4.9.3","4.9.4","4.9.5","4.9.6","4.9.7","4.9.8","4.9.9"],"database_specific":{"source":"https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2026/03/GHSA-2hcp-gjrf-7fhc/GHSA-2hcp-gjrf-7fhc.json"}}],"schema_version":"1.9.0","severity":[{"type":"CVSS_V3","score":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H"}]}