{"id":"CVE-2026-44241","summary":"Micronaut Framework: Unbounded formattersCache in TimeConverterRegistrar Allows Memory Exhaustion via Accept-Language Header","details":"Micronaut Framework is a JVM-based full stack Java framework designed for building modular, easily testable JVM applications. From 4.3.0 to before 4.10.22, 3.10.6, and 3.8.14, TimeConverterRegistrar caches DateTimeFormatter instances in an unbounded ConcurrentHashMap\u003cString, DateTimeFormatter\u003e whose key is derived from the @Format annotation pattern concatenated with the locale from the HTTP Accept-Language header. Because Locale.forLanguageTag() accepts arbitrary BCP 47 private-use extensions (en-x-a001, en-x-a002, …), an unauthenticated attacker can generate an unlimited number of unique cache keys by sending requests with novel locale tags, growing the cache until heap memory is exhausted and the JVM crashes. This vulnerability is fixed in 4.10.22, 3.10.6, and 3.8.14.","aliases":["GHSA-8hjv-92q9-g4xj"],"modified":"2026-10-30T13:02:58.414200432Z","published":"2026-05-12T21:20:45.249Z","database_specific":{"osv_generated_from":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/44xxx/CVE-2026-44241.json","cna_assigner":"GitHub_M","cwe_ids":["CWE-400"]},"references":[{"type":"WEB","url":"https://github.com/micronaut-projects/micronaut-core/releases/tag/v3.10.6"},{"type":"WEB","url":"https://github.com/micronaut-projects/micronaut-core/releases/tag/v3.8.14"},{"type":"WEB","url":"https://github.com/micronaut-projects/micronaut-core/releases/tag/v4.10.22"},{"type":"ADVISORY","url":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/44xxx/CVE-2026-44241.json"},{"type":"ADVISORY","url":"https://github.com/micronaut-projects/micronaut-core/security/advisories/GHSA-8hjv-92q9-g4xj"},{"type":"ADVISORY","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-44241"},{"type":"FIX","url":"https://github.com/micronaut-projects/micronaut-core/commit/48f05ae8dc4157816fe0050c5cf730be7d44f8b3"},{"type":"FIX","url":"https://github.com/micronaut-projects/micronaut-core/commit/c2048ab740c2efdfe227813f203176e0ef93f892"},{"type":"FIX","url":"https://github.com/micronaut-projects/micronaut-core/commit/c6ca8782de7338732e887d090f38c9e941bcb284"}],"affected":[{"ranges":[{"type":"GIT","repo":"https://github.com/micronaut-projects/micronaut-core","events":[{"introduced":"afdc5e835feff99bb9c65c2972f8b0029ec3294e"},{"fixed":"b8c9ecd4f52e2a3553d1083d8045268f9bc31568"},{"introduced":"98f304a03f28ae1fddb2265cae810bbcb3a77cf8"},{"fixed":"324db9bc8fd0187f8b9009481f452cbb7d689a07"},{"introduced":"0"},{"fixed":"b9562e09a80ac09dcac79b5ab3a797111fd0c12a"},{"fixed":"48f05ae8dc4157816fe0050c5cf730be7d44f8b3"},{"fixed":"c2048ab740c2efdfe227813f203176e0ef93f892"},{"fixed":"c6ca8782de7338732e887d090f38c9e941bcb284"}],"database_specific":{"extracted_events":[{"strategy":"StringRangeExpression","range":[{"introduced":"4.3.0"},{"fixed":"4.10.22"}],"source":"AFFECTED_FIELD"},{"range":[{"introduced":"3.10.0"},{"fixed":"3.10.6"}],"source":"AFFECTED_FIELD","strategy":"StringRangeExpression"},{"strategy":"StringRangeExpression","range":[{"introduced":"0"},{"fixed":"3.8.14"}],"source":"AFFECTED_FIELD"},{"range":[{"fixed":"48f05ae8dc4157816fe0050c5cf730be7d44f8b3"}],"source":"REFERENCES_COMMIT"},{"range":[{"fixed":"c2048ab740c2efdfe227813f203176e0ef93f892"}],"source":"REFERENCES_COMMIT"},{"range":[{"fixed":"c6ca8782de7338732e887d090f38c9e941bcb284"}],"source":"REFERENCES_COMMIT"},{"range":[{"fixed":"324db9bc8fd0187f8b9009481f452cbb7d689a07"}],"source":"REFERENCES_TAG","original_tag":"v3.10.6"},{"original_tag":"v3.8.14","range":[{"fixed":"b9562e09a80ac09dcac79b5ab3a797111fd0c12a"}],"source":"REFERENCES_TAG"},{"source":"REFERENCES_TAG","original_tag":"v4.10.22","range":[{"fixed":"b8c9ecd4f52e2a3553d1083d8045268f9bc31568"}]}]}}],"versions":["v4.10.21","v4.10.20","v4.10.19","v3.8.13","v4.10.18","v4.10.17","v3.10.5","v4.10.16","v4.10.15","v4.10.14","v4.10.13","v4.10.12","v4.10.11","v4.10.10","v4.10.9","v4.10.8","v4.10.7","v4.10.6","v4.10.5","v4.10.4","v4.10.3","v4.10.2","v4.10.1","v4.10.0","v4.7.0","v4.5.3","v4.6.1","v4.6.0","v4.5.2","v4.5.1","v4.5.0","v4.4.1","v4.4.0","v3.10.4","v4.3.4","v4.3.3","v4.3.2","v4.3.1","v4.3.0","v3.10.3","v3.10.2","v3.8.12","v3.8.11","v3.10.1","v3.8.10","v3.10.0","v3.8.9","v3.8.8","v3.8.7","v3.8.6","v3.8.5","v3.8.4","v3.8.3","v3.8.2","v3.8.1","v3.8.0","v3.7.0","v3.6.0","v3.5.0","v3.4.0","v3.3.0-M1","v3.2.0","v3.1.0","v3.0.0","v3.0.0-RC1","v3.0.0-M5","v3.0.0-M4","v3.0.0-M2","v2.0.1","v2.0.0","v2.0.0.RC2","v2.0.0.RC1","v1.3.0","v1.3.0.RC1","v1.3.0.M2","v1.3.0.TEST","v1.3.0.M1","v1.2.0","v1.2.0.RC2","v1.2.0.RC1","v1.1.0.RC2","v1.1.0.RC1","v1.1.0.M2","v1.1.0.M1","v1.0.0","v1.0.0.RC3","v1.0.0.RC2","v1.0.0.M4","v1.0.0.M3","v1.0.0.M2","v1.0.0.M1"],"database_specific":{"source":"https://storage.googleapis.com/osv-test-cve-osv-conversion/osv-output/CVE-2026-44241.json","vanir_signatures":[{"target":{"file":"test-suite/src/test/java/io/micronaut/docs/i18n/I18nSpec.java"},"deprecated":false,"digest":{"line_hashes":["235645972828502446935776755092165007574","31508542860075405955303203240361514933","180537869163193240014348190917521796492","9396643822110404770108866704272722678","284062490427070748833180207817183092491","185282934765245458678050590856900723899"],"threshold":0.9},"id":"CVE-2026-44241-017a7734","signature_type":"Line","signature_version":"v1","source":"https://github.com/micronaut-projects/micronaut-core/commit/48f05ae8dc4157816fe0050c5cf730be7d44f8b3"},{"signature_version":"v1","source":"https://github.com/micronaut-projects/micronaut-core/commit/c2048ab740c2efdfe227813f203176e0ef93f892","target":{"file":"inject/src/main/java/io/micronaut/context/i18n/ResourceBundleMessageSource.java","function":"buildMessageCache"},"deprecated":false,"digest":{"function_hash":"211685114345995618441465145738440046121","length":125},"id":"CVE-2026-44241-0d32d93c","signature_type":"Function"},{"source":"https://github.com/micronaut-projects/micronaut-core/commit/c6ca8782de7338732e887d090f38c9e941bcb284","target":{"file":"test-suite/src/test/java/io/micronaut/docs/i18n/MessageSourceFactory.java"},"deprecated":false,"digest":{"line_hashes":["108999436055381863277681521950495633325","176728726314661523827945682999824681307","255354872201202018507904612917300954357","213269567184829752097095076672218636584","108565032419447552531996434625721866744"],"threshold":0.9},"id":"CVE-2026-44241-188a89cf","signature_type":"Line","signature_version":"v1"},{"source":"https://github.com/micronaut-projects/micronaut-core/commit/48f05ae8dc4157816fe0050c5cf730be7d44f8b3","target":{"function":"buildBundleCache","file":"inject/src/main/java/io/micronaut/context/i18n/ResourceBundleMessageSource.java"},"deprecated":false,"digest":{"function_hash":"182126230605009213399559510859972704279","length":64},"id":"CVE-2026-44241-29c1eb42","signature_type":"Function","signature_version":"v1"},{"id":"CVE-2026-44241-34322d6a","signature_type":"Function","signature_version":"v1","source":"https://github.com/micronaut-projects/micronaut-core/commit/c6ca8782de7338732e887d090f38c9e941bcb284","target":{"function":"buildBundleCache","file":"inject/src/main/java/io/micronaut/context/i18n/ResourceBundleMessageSource.java"},"deprecated":false,"digest":{"function_hash":"182126230605009213399559510859972704279","length":64}},{"signature_version":"v1","source":"https://github.com/micronaut-projects/micronaut-core/commit/c6ca8782de7338732e887d090f38c9e941bcb284","target":{"function":"buildMessageCache","file":"inject/src/main/java/io/micronaut/context/i18n/ResourceBundleMessageSource.java"},"deprecated":false,"digest":{"function_hash":"211685114345995618441465145738440046121","length":125},"id":"CVE-2026-44241-4511393a","signature_type":"Function"},{"target":{"file":"inject/src/main/java/io/micronaut/context/i18n/ResourceBundleMessageSource.java"},"deprecated":false,"digest":{"line_hashes":["8437407419730278381253884358095840596","98470632119093303848064675452972729026","188961521313613192922488566742089976324","307384448715499488333688610703549931342","290121005509465335529046822732034739447","94995687996577484898593332926608467359","214530537441317772985569624565667652785","85105516174979872330005100109360117434","145261159719514924602195253977986590148","307672692636449149124081889158210989634","227726977428322675328635767500924896184","10842237988833752285974728836736910986"],"threshold":0.9},"id":"CVE-2026-44241-4753bed2","signature_type":"Line","signature_version":"v1","source":"https://github.com/micronaut-projects/micronaut-core/commit/c2048ab740c2efdfe227813f203176e0ef93f892"},{"signature_version":"v1","source":"https://github.com/micronaut-projects/micronaut-core/commit/c2048ab740c2efdfe227813f203176e0ef93f892","target":{"file":"test-suite/src/test/java/io/micronaut/docs/i18n/MessageSourceFactory.java"},"deprecated":false,"digest":{"line_hashes":["108999436055381863277681521950495633325","176728726314661523827945682999824681307","255354872201202018507904612917300954357","213269567184829752097095076672218636584","108565032419447552531996434625721866744"],"threshold":0.9},"id":"CVE-2026-44241-4e794d4a","signature_type":"Line"},{"signature_type":"Line","signature_version":"v1","source":"https://github.com/micronaut-projects/micronaut-core/commit/48f05ae8dc4157816fe0050c5cf730be7d44f8b3","target":{"file":"inject/src/main/java/io/micronaut/context/i18n/ResourceBundleMessageSource.java"},"deprecated":false,"digest":{"line_hashes":["198468689391206069996567458447453100334","198589488301231758786749794811914185619","135312823934277744663089049030212995932","99469152314724515603808114774496305527","290121005509465335529046822732034739447","94995687996577484898593332926608467359","214530537441317772985569624565667652785","85105516174979872330005100109360117434","145261159719514924602195253977986590148","307672692636449149124081889158210989634","227726977428322675328635767500924896184","10842237988833752285974728836736910986"],"threshold":0.9},"id":"CVE-2026-44241-671fdd79"},{"signature_type":"Line","signature_version":"v1","source":"https://github.com/micronaut-projects/micronaut-core/commit/c6ca8782de7338732e887d090f38c9e941bcb284","target":{"file":"test-suite/src/test/java/io/micronaut/docs/i18n/I18nSpec.java"},"deprecated":false,"digest":{"line_hashes":["235645972828502446935776755092165007574","31508542860075405955303203240361514933","180537869163193240014348190917521796492","9396643822110404770108866704272722678","284062490427070748833180207817183092491","185282934765245458678050590856900723899"],"threshold":0.9},"id":"CVE-2026-44241-7e29c97b"},{"id":"CVE-2026-44241-ae870e7d","signature_type":"Function","signature_version":"v1","source":"https://github.com/micronaut-projects/micronaut-core/commit/c2048ab740c2efdfe227813f203176e0ef93f892","target":{"file":"inject/src/main/java/io/micronaut/context/i18n/ResourceBundleMessageSource.java","function":"buildBundleCache"},"deprecated":false,"digest":{"function_hash":"182126230605009213399559510859972704279","length":64}},{"deprecated":false,"digest":{"line_hashes":["108999436055381863277681521950495633325","188133224889379737141537730250565553461","308814968571757340362179139895933028713","276851640289277706324690092549977214090","207448550083414861393518118692171929919","108565032419447552531996434625721866744"],"threshold":0.9},"id":"CVE-2026-44241-c97ae328","signature_type":"Line","signature_version":"v1","source":"https://github.com/micronaut-projects/micronaut-core/commit/48f05ae8dc4157816fe0050c5cf730be7d44f8b3","target":{"file":"test-suite/src/test/java/io/micronaut/docs/i18n/MessageSourceFactory.java"}},{"digest":{"line_hashes":["235645972828502446935776755092165007574","31508542860075405955303203240361514933","180537869163193240014348190917521796492","9396643822110404770108866704272722678","284062490427070748833180207817183092491","185282934765245458678050590856900723899"],"threshold":0.9},"id":"CVE-2026-44241-ce22b923","signature_type":"Line","signature_version":"v1","source":"https://github.com/micronaut-projects/micronaut-core/commit/c2048ab740c2efdfe227813f203176e0ef93f892","target":{"file":"test-suite/src/test/java/io/micronaut/docs/i18n/I18nSpec.java"},"deprecated":false},{"digest":{"length":125,"function_hash":"211685114345995618441465145738440046121"},"id":"CVE-2026-44241-e2dc9c62","signature_type":"Function","signature_version":"v1","source":"https://github.com/micronaut-projects/micronaut-core/commit/48f05ae8dc4157816fe0050c5cf730be7d44f8b3","target":{"file":"inject/src/main/java/io/micronaut/context/i18n/ResourceBundleMessageSource.java","function":"buildMessageCache"},"deprecated":false},{"signature_version":"v1","source":"https://github.com/micronaut-projects/micronaut-core/commit/c6ca8782de7338732e887d090f38c9e941bcb284","target":{"file":"inject/src/main/java/io/micronaut/context/i18n/ResourceBundleMessageSource.java"},"deprecated":false,"digest":{"line_hashes":["8437407419730278381253884358095840596","98470632119093303848064675452972729026","188961521313613192922488566742089976324","307384448715499488333688610703549931342","290121005509465335529046822732034739447","94995687996577484898593332926608467359","214530537441317772985569624565667652785","85105516174979872330005100109360117434","145261159719514924602195253977986590148","307672692636449149124081889158210989634","227726977428322675328635767500924896184","10842237988833752285974728836736910986"],"threshold":0.9},"id":"CVE-2026-44241-f47d53a8","signature_type":"Line"}],"vanir_signatures_modified":"2026-10-30T13:02:58Z"}}],"schema_version":"1.9.2","severity":[{"type":"CVSS_V3","score":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H"}]}