CVE-2026-44242 Micronaut has Unbounded `bundleCache` in `ResourceBundleMessageSource` that Allows Memory Exhaustion via `Accept-Language` Header
An unauthenticated attacker can exhaust heap memory and cause denial of service by sending requests with unique Accept-Language headers in applications using ResourceBundleMessageSource.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2026-44242?
CVE-2026-44242 is a low-severity denial of service vulnerability in micronaut-projects micronaut-core, published on 12 May 2026. An attacker can exploit it over the internet without logging in, with no action from the victim.
Official description
Micronaut Framework is a JVM-based full stack Java framework designed for building modular, easily testable JVM applications. Prior to 4.10.22, the bundleCache is keyed by (Locale, baseName) where the locale originates from the HTTP Accept-Language header. In applications that explicitly register a ResourceBundleMessageSource bean and serve HTML error responses, an unauthenticated attacker can exhaust heap memory by sending requests with large numbers of unique Accept-Language values, each causing a new entry in the unbounded bundleCache. This vulnerability is fixed in 4.10.22.
Weakness: CWE-400
Which versions are affected by CVE-2026-44242?
6 open source packages ship an affected version, including io.micronaut:micronaut-inject.
| Package | Affected | Fixed in |
|---|---|---|
io.micronaut:micronaut-inject Maven | All versions | 3.8.14 |
io.micronaut:micronaut-inject Maven | All versions | 3.8.14 |
io.micronaut:micronaut-inject Maven | From 3.10.0 | 3.10.6 |
io.micronaut:micronaut-inject Maven | From 3.10.0 | 3.10.6 |
io.micronaut:micronaut-inject Maven | From 4.10.0 | 4.10.22 |
io.micronaut:micronaut-inject Maven | From 4.10.0 | 4.10.22 |
How do I fix CVE-2026-44242?
Upgrade io.micronaut:micronaut-inject to a fixed version for your release line: 3.8.14, 3.10.6 or 4.10.22.
Upgrade, then put limits on request size, rate and nesting depth so one client cannot exhaust the service. More about Denial of service.
Is CVE-2026-44242 being exploited?
It is not confirmed as exploited in the wild, but public exploit code for CVE-2026-44242 exists.
Sources
Also known as ECHO-78e3-aff5-2f5b, GHSA-3rfq-4wpf-qqw3.