7.5

CVSS Score

3.1

-

CVSS Score

Basic Information

Concerned about an active attack path?

Talk to our security experts and see Miggo in action.

Miggo Vulnerability Database

→

CVE-2026-33012

CVE-2026-33012: Micronaut Framework vulnerable to a Denial of Service in HTML error response caching

Micronaut Framework is a JVM-based full stack Java framework designed for building modular, easily testable JVM applications. Versions 4.7.0 through 4.10.16 used an unbounded ConcurrentHashMap cache with no eviction policy in its DefaultHtmlErrorResponseBodyProvider. If the application throws an exception whose message may be influenced by an attacker, (for example, including request query value parameters) it could be used by remote attackers to cause an unbounded heap growth and OutOfMemoryError, leading to DoS. This issue has been fixed in version 4.10.7.

(GitHub Advisory)

Miggo Vulnerability Database

→

CVE-2026-33012

CVE-2026-33012:

7.5

CVSS Score

3.1

-

CVSS Score

Basic Information

Is this CVE running in your environment?

Easily map the attack path and prioritize which CVEs are a threat to your organization

Validate Exposure

Technical Details

Package Name	Ecosystem	Vulnerable Versions	First Patched Version
io.micronaut:micronaut-http-server	maven	>= 4.7.0, < 4.10.17	4.10.17

Technical Details

Vulnerability Intelligence
Miggo AI

Root Cause Analysis

The vulnerability lies in the DefaultHtmlErrorResponseBodyProvider class, which was using an unbounded ConcurrentHashMap for caching HTML error responses. The security patch, identified in commit 1e2ba2c14386af3d47751732d02053a72b0b49b3, replaces this with a ConcurrentLinkedHashMap with a fixed upper bound (MAX_CACHE_SIZE = 100). The primary function that interacts with this cache is body(ErrorContext errorContext), which is responsible for generating the HTML error page. When an exception occurs, this method is invoked. If an attacker can control parts of the exception message, they can generate a large number of unique error pages, causing the cache to grow indefinitely. Therefore, io.micronaut.http.server.exceptions.response.DefaultHtmlErrorResponseBodyProvider.body is the key function that would appear in a runtime profile during exploitation, as it's directly responsible for populating the unbounded cache that leads to the Denial of Service.

Vulnerable functions

io.micronaut.http.server.exceptions.response.DefaultHtmlErrorResponseBodyProvider.body

http-server/src/main/java/io/micronaut/http/server/exceptions/response/DefaultHtmlErrorResponseBodyProvider.java

The `DefaultHtmlErrorResponseBodyProvider` class uses a `cache` field, which was an unbounded `ConcurrentHashMap`, to store generated HTML error pages. The `body` method is responsible for generating and caching these error responses. An attacker could repeatedly trigger exceptions with unique messages (for example, by including unique values in request parameters which are then reflected in the exception message). Each unique error would be cached by the `body` method, leading to uncontrolled growth of the cache, which would eventually cause an `OutOfMemoryError` and result in a Denial of Service.

Vulnerability Intelligence
Miggo AI

Unlock WAF rules for this CVE

Generate vendor-ready rules for the observed attack patterns, plus reasoning and safe deployment guidance

Get WAF rules

WAF Protection Rules

WAF Rule

W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.

Reasoning

*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.