CVE-2026-33012: Micronaut HTTP Server Denial of Service Vulnerability in Error Response Caching
Summary
CVE-2026-33012: Micronaut Framework vulnerable to a Denial of Service in HTML error response caching. Affects io.micronaut:micronaut-http-server versions >= 4.7.0, < 4.10.17. Fixed in 4.10.17. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
The Micronaut Framework is a modern, JVM-based framework designed for building modular, easily testable microservices and serverless applications. It provides features such as dependency injection, AOP, and HTTP server capabilities. The micronaut-http-server package is responsible for handling HTTP requests and responses, making it a critical component for applications built using Micronaut. However, a vulnerability has been identified in versions 4.7.0 to 4.10.7 that could lead to denial of service due to unbounded caching of HTML error responses.
Vulnerability Detail
The vulnerability arises from the DefaultHtmlErrorResponseBodyProvider class in the io.micronaut:micronaut-http-server package, which, from version 4.7.0 to 4.10.7, utilized an unbounded ConcurrentHashMap cache without any eviction policy. This means that if an application throws an exception with a message influenced by an attacker (such as including request query parameters), it could lead to unbounded heap growth, ultimately causing an OutOfMemoryError and resulting in denial of service. The severity of this vulnerability is rated high, with a CVSS score of 7.5.
How To Fix
Minimum fixed version
4.10.17
This is the first release that contains the fix.
Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
As a temporary workaround, consider implementing a custom error response handler that limits the size of cached error responses or avoids caching altogether until the package can be updated.
Conclusion
In summary, the Micronaut Framework's micronaut-http-server package has a critical vulnerability that could lead to denial of service due to unbounded caching of HTML error responses. It is essential to update to the patched version to mitigate this risk.
See every vulnerability recorded for io.micronaut:micronaut-http-server →
FAQ
The vulnerability can lead to denial of service due to unbounded heap growth, which may crash the application.
Versions 4.7.0 to 4.10.7 of the micronaut-http-server package are affected by this vulnerability.
You can use Vulert to monitor and alert for open-source vulnerabilities in your software. Check your application's pom.xml using the Vulert playground at Vulert Scanner.
The CVSS score of this vulnerability is 7.5, indicating a high severity level.
Yes, the vulnerability has been fixed in version 4.10.17 of the micronaut-http-server package.
References
Related vulnerabilities
Recent vulnerabilities recorded for io.micronaut:micronaut-http-server.
