Executive Summary

A high-severity denial-of-service (DoS) vulnerability, CVE-2026-33012, has been identified in the Micronaut Framework, a modern, JVM-based framework for building microservices and serverless applications. The vulnerability, rated with a CVSS score of 7.5, allows a remote attacker to trigger an OutOfMemoryError by exhausting the server's heap memory, leading to a complete application crash. The root cause is an unbounded cache within the framework's HTML error response provider. An attacker can force the application to generate and cache an infinite number of unique error pages, causing uncontrolled memory growth. The flaw affects Micronaut versions 4.7.0 through 4.10.6 and has been remediated in version 4.10.7.

Vulnerability Details

The vulnerability exists within the DefaultHtmlErrorResponseBodyProvider class, which is responsible for generating HTML error pages when an exception occurs. To improve performance, this class caches the generated HTML bodies in a ConcurrentHashMap.

The Flaw: The ConcurrentHashMap used for caching was unbounded, meaning it had no limit on the number of entries it could store and no eviction policy to remove old entries. The key for this cache is the error message from the thrown exception.

A remote attacker can exploit this by interacting with an application endpoint in a way that triggers an exception where the error message contains attacker-controlled input. For example, if a request parameter is used in an error message (e.g., "Invalid value provided: [attacker_input]"), the attacker can send a large number of requests with unique values for that parameter. Each request generates a new, unique exception message, which in turn creates a new, unique entry in the unbounded cache. This allows the attacker to force the cache to grow indefinitely, consuming all available heap memory and ultimately causing the JVM to throw an OutOfMemoryError, crashing the application.

This attack is a form of Application Exhaustion Flood, mapped to T1499.003.

Affected Systems

• Micronaut Framework: Versions 4.7.0 up to, but not including, 4.10.7.

Any application built with an affected version of the Micronaut Framework is potentially vulnerable if it can throw exceptions with user-controllable messages.

Exploitation Status

There are currently no reports of this vulnerability being exploited in the wild. However, the conditions for exploitation are common in many web applications, and the public disclosure increases the risk of opportunistic attacks.

Impact Assessment

The impact of CVE-2026-33012 is a denial of service. An attacker can render any application built on a vulnerable Micronaut version unavailable. This can lead to business disruption, loss of revenue, and damage to customer trust. The attack requires no authentication and can be carried out with simple automated scripts, making it easy to execute. For organizations running critical services on Micronaut, this vulnerability poses a significant operational risk.

Cyber Observables for Detection

Detection Methods

• Application Performance Monitoring (APM): The most effective way to detect this attack in progress is by monitoring JVM health metrics. Configure alerts in your APM solution for JVM heap memory usage that exceeds a certain threshold (e.g., 90%) and for OutOfMemoryError events. This is a form of D3FEND Process Analysis.
• Log Analysis: Centralize application logs and create alerts for a high frequency of exception messages originating from the same source IP but with slightly different content. This can indicate an attempt to pollute the error cache.
• Rate Limiting: While not a direct detection method, implementing rate limiting on API endpoints can slow down an attacker and make the anomalous traffic easier to spot.

Remediation Steps

1. Update Software (M1051): The only definitive solution is to upgrade the Micronaut Framework to a patched version:
   • Upgrade to version 4.10.7 or newer.

The fix replaces the unbounded ConcurrentHashMap with a ConcurrentLinkedHashMap that is configured with a maximum size of 100 entries. This prevents the cache from growing uncontrollably. This remediation is a direct application of the D3FEND Software Update technique.

2. Code Review (as a compensating practice): As a general best practice, developers should avoid including raw user input in exception messages. This reduces the attack surface for this and other types of injection or manipulation vulnerabilities. This relates to D3FEND Application Hardening.