Signal is active with 1 mentions in latest observed window
Recommended action window: Monitor and triage in normal cycle
NVD description
Micronaut Framework is a JVM-based full stack Java framework designed for building modular, easily testable JVM applications. From 4.3.0 to before 4.10.22, 3.10.6, and 3.8.14, TimeConverterRegistrar caches DateTimeFormatter instances in an unbounded ConcurrentHashMap<String, DateTimeFormatter> whose key is derived from the @Format annotation pattern concatenated with the locale from the HTTP Accept-Language header. Because Locale.forLanguageTag() accepts arbitrary BCP 47 private-use extensions (en-x-a001, en-x-a002, …), an unauthenticated attacker can generate an unlimited number of unique cache keys by sending requests with novel locale tags, growing the cache until heap memory is exhausted and the JVM crashes. This vulnerability is fixed in 4.10.22, 3.10.6, and 3.8.14.
Priority
LOW
Exploitation
NONE
PoC
NONE
Patch
NONE
Momentum
STABLE
| Date | Total | Labels |
|---|
| 2026-05-12 | 1 | General1 |
| 2026-05-13 | 1 | Disclosure1 |
CVE-2026-44241 Denial of Service via Unbounded Cache in Micronaut Framework 4.3.0-4.10.21 https://vulmon.com/vulnerabilitydetails?qid=CVE-2026-44241
Post summary
The text announces a new denial‑of‑service vulnerability in Micronaut Framework, providing basic technical details but no PoC, exploit, or patch information.
CVE-2026-44241 Micronaut Framework is a JVM-based full stack Java framework designed for building modular, easily testable JVM applications. From 4.3.0 to before 4.10.22, TimeConver… https://www.cve.org/CVERecord?id=CVE-2026-44241
Post summary
The snippet merely announces CVE‑2026‑44241 with a reference to its CVE record and a version range, but provides no technical or actionable details.