CVE-2026-44242

Micronaut Framework is a JVM-based full stack Java framework designed for building modular, easily testable JVM applications. Prior to 4.10.22, the bundleCache is keyed by Locale, baseName where the locale originates from the HTTP Accept-Language header. In applications that explicitly register a...

CVE-2026-44242

CVE-2026-44242 affects Micronaut Framework when a non-default ResourceBundleMessageSource bean is registered. The bundleCache is a ConcurrentHashMap unbounded by design, allowing an attacker to flood the server with unique Accept-Language headers (while requesting HTML error responses), creating ...

CVE-2026-44242 Micronaut Framework: Unbounded bundleCache in ResourceBundleMessageSource Allows Memory Exhaustion via Accept-Language Header

Micronaut Framework is a JVM-based full stack Java framework designed for building modular, easily testable JVM applications. Prior to 4.10.22, the bundleCache is keyed by Locale, baseName where the locale originates from the HTTP Accept-Language header. In applications that explicitly register a...

io.micronaut.configuration:micronaut-jmx (1.2.0.rc2), io.micronaut:micronaut-aop (1.2.0.rc2) +25 more potentially affected by CVE-2026-44242 via io.micronaut:micronaut-inject (1.2.0.rc2)

io.micronaut:micronaut-inject MAVEN version 1.2.0.rc2 is affected by a known vulnerability. The following packages have a transitive dependency on io.micronaut:micronaut-inject and may be impacted: - io.micronaut.configuration:micronaut-jmx 1.2.0.rc2 - io.micronaut:micronaut-aop 1.2.0.rc2 -...

de.codecentric.hikaku:hikaku-micronaut (3.0.1), io.eventuate.common:eventuate-common-micronaut-data-jdbc (0.13.0.release) +58 more potentially affected by CVE-2026-44242 via io.micronaut:micronaut-inject (1.2.4)

io.micronaut:micronaut-inject MAVEN version 1.2.4 is affected by a known vulnerability. The following packages have a transitive dependency on io.micronaut:micronaut-inject and may be impacted: - de.codecentric.hikaku:hikaku-micronaut 3.0.1 - io.eventuate.common:eventuate-common-micronaut-data-jd...

com.github.seratch:jslack-lightning-micronaut (>=3.1.1, <=3.4.2), de.codecentric.hikaku:hikaku-micronaut (3.1.1) +55 more potentially affected by CVE-2026-44242 via io.micronaut:micronaut-inject (1.2.6)

io.micronaut:micronaut-inject MAVEN version 1.2.6 is affected by a known vulnerability. The following packages have a transitive dependency on io.micronaut:micronaut-inject and may be impacted: - com.github.seratch:jslack-lightning-micronaut =3.1.1, =3.4.2 - de.codecentric.hikaku:hikaku-micronaut...

io.micronaut.cache:micronaut-cache-ehcache (1.0.0.rc1), io.micronaut.cache:micronaut-cache-hazelcast (1.0.0.rc1) +35 more potentially affected by CVE-2026-44242 via io.micronaut:micronaut-inject (1.3.0.rc1)

io.micronaut:micronaut-inject MAVEN version 1.3.0.rc1 is affected by a known vulnerability. The following packages have a transitive dependency on io.micronaut:micronaut-inject and may be impacted: - io.micronaut.cache:micronaut-cache-ehcache 1.0.0.rc1 - io.micronaut.cache:micronaut-cache-hazelca...

com.slack.api:bolt-micronaut (>=1.5.0-rc1, <=1.5.3), de.codecentric.hikaku:hikaku-micronaut (3.2.0) +85 more potentially affected by CVE-2026-44242 via io.micronaut:micronaut-inject (2.2.3)

io.micronaut:micronaut-inject MAVEN version 2.2.3 is affected by a known vulnerability. The following packages have a transitive dependency on io.micronaut:micronaut-inject and may be impacted: - com.slack.api:bolt-micronaut =1.5.0-rc1, =2.0.0, =2.0.1 - io.micronaut.aws:micronaut-aws-alexa 2.3.0 ...

com.slack.api:bolt-micronaut (>=1.6.0, <=1.6.1), info.novatec:micronaut-camunda-bpm-feature (0.16.1) +42 more potentially affected by CVE-2026-44242 via io.micronaut:micronaut-inject (2.3.1)

io.micronaut:micronaut-inject MAVEN version 2.3.1 is affected by a known vulnerability. The following packages have a transitive dependency on io.micronaut:micronaut-inject and may be impacted: - com.slack.api:bolt-micronaut =1.6.0, =2.3.0, =2.3.0, =2.3.0, =2.3.0, =1.2.0, =1.2.0, =1.2.0, =1.2.0,...

com.github.jasontypescodes:mn-config-based-auth (0.1.0), info.novatec:micronaut-camunda-bpm-feature (0.23.0) +110 more potentially affected by CVE-2026-44242 via io.micronaut:micronaut-inject (2.4.2)

io.micronaut:micronaut-inject MAVEN version 2.4.2 is affected by a known vulnerability. The following packages have a transitive dependency on io.micronaut:micronaut-inject and may be impacted: - com.github.jasontypescodes:mn-config-based-auth 0.1.0 - info.novatec:micronaut-camunda-bpm-feature...

com.github.goodforgod:micronaut-arangodb (2.1.2), com.github.goodforgod:micronaut-clickhouse (2.2.1) +42 more potentially affected by CVE-2026-44242 via io.micronaut:micronaut-inject (2.5.4)

io.micronaut:micronaut-inject MAVEN version 2.5.4 is affected by a known vulnerability. The following packages have a transitive dependency on io.micronaut:micronaut-inject and may be impacted: - com.github.goodforgod:micronaut-arangodb 2.1.2 - com.github.goodforgod:micronaut-clickhouse 2.2.1 -...

com.agorapulse:micronaut-amazon-awssdk-cloudwatch (>=1.6.1-micronaut-3.0, <=2.2.2-micronaut-3.0), com.agorapulse:micronaut-amazon-awssdk-cloudwatchlogs (>=2.0.8-micronaut-3.0, <=2.2.2-micronaut-3.0) +682 more potentially affected by CVE-2026-44242 via io.micronaut:micronaut-inject (>=3.0.0-m1, <=3.8.13)

io.micronaut:micronaut-inject MAVEN version =3.0.0-m1, =1.6.1-micronaut-3.0, =2.0.8-micronaut-3.0, =1.6.1-micronaut-3.0, =1.6.1-micronaut-3.0, =1.7.3-micronaut-3.0, =1.6.2-micronaut-3.0, =2.0.0-micronaut-3.0, =1.7.2-micronaut-3.0, =1.6.1-micronaut-3.0, =1.7.3-micronaut-3.0, =1.6.1-micronaut-3.0,...

com.atomise:pii-micronaut (>=0.1.0, <=0.2.0), com.c0x12c:module-ai-image (>=0.12.0, <=0.17.0) +801 more potentially affected by CVE-2026-44242 via io.micronaut:micronaut-inject (>=4.3.0, <=4.10.21)

io.micronaut:micronaut-inject MAVEN version =4.3.0, =0.1.0, =0.12.0, =0.5.0, =0.2.15, =0.5.0, =0.5.0, =0.5.0, =0.5.0, =0.2.6, =0.2.5, =0.2.6, =0.5.0, =0.10.0, =0.8.0, =0.17.0 and more Source cves: CVE-2026-44242 Source advisory: SNYK:JAVA-IOMICRONAUT-16478712...