Skip to content
Threat Feed

Product

Micronaut-Context

1 brief RSS
medium advisory

Micronaut TimeConverterRegistrar Memory Exhaustion via Accept-Language Header

Micronaut's `TimeConverterRegistrar` has an unbounded `formattersCache` that allows memory exhaustion via a crafted `Accept-Language` header, where an unauthenticated attacker can crash the JVM by sending requests with novel locale tags to `@Format`-annotated endpoints, growing the cache until heap memory is exhausted, affecting Micronaut applications with `micronaut-context` versions 4.3.0 and above, up to but not including 4.10.22.

micronaut-context dos memory-exhaustion micronaut
3r 2t