CVE-2026-33012: 
Java vulnerability analysis and mitigation

CVE-2026-33012 is a Denial of Service vulnerability in the Micronaut Framework's io.micronaut:micronaut-http-server package, specifically in the DefaultHtmlErrorResponseBodyProvider class. The flaw affects versions 4.7.0 through 4.10.16 and was introduced by the use of an unbounded ConcurrentHashMap cache with no eviction policy for HTML error responses. It was discovered by researcher shblue21, disclosed via GitHub Security Advisory on March 16, 2026, and published to the NVD on March 20, 2026. The vulnerability carries a CVSS v3.1 base score of 7.5 (High) (Github Advisory, Red Hat Bugzilla).

The root cause is classified as CWE-770 (Allocation of Resources Without Limits or Throttling). The DefaultHtmlErrorResponseBodyProvider cached rendered HTML error responses in a ConcurrentHashMap with no maximum size or eviction policy; if an application throws exceptions whose messages incorporate attacker-controlled input (e.g., request query parameters or URI components), each unique exception message generates a distinct cache entry. An unauthenticated remote attacker can flood the application with requests containing unique query parameters, causing the cache to grow without bound, ultimately exhausting JVM heap memory and triggering an OutOfMemoryError. The fix, applied in commit 1e2ba2c, replaces the unbounded ConcurrentHashMap with a ConcurrentLinkedHashMap capped at 100 entries (Github Advisory, Patch Commit).

Successful exploitation results in unbounded JVM heap growth leading to an OutOfMemoryError, causing a complete denial of service for the affected Micronaut application. There is no impact on confidentiality or data integrity — the vulnerability is purely an availability issue. All services hosted by the affected Micronaut instance would become unavailable until the process is restarted, and persistent exploitation could prevent recovery without rate-limiting controls (Github Advisory, Red Hat Bugzilla).

1. Reconnaissance: Identify internet-facing applications built on Micronaut Framework versions 4.7.0–4.10.16 using HTTP response headers (e.g., X-Micronaut-*) or known API patterns.
2. Identify triggerable error endpoints: Find endpoints that return HTML error responses (i.e., requests with Accept: text/html) and where exception messages incorporate attacker-controlled input such as query parameters or URI segments.
3. Craft unique requests: Generate a large volume of HTTP requests to the identified endpoint, each with a unique query parameter value (e.g., ?nonce=1, ?nonce=2, ...) to ensure each request produces a distinct exception message and a unique cache entry.
4. Flood the cache: Send requests continuously and rapidly; each unique exception message is stored as a new entry in the unbounded ConcurrentHashMap, consuming increasing amounts of JVM heap memory.
5. Trigger OutOfMemoryError: After sufficient unique entries accumulate, the JVM heap is exhausted, causing an OutOfMemoryError and crashing or hanging the Micronaut application process, resulting in a denial of service (Patch Commit, Github Advisory).

• Network: High volume of HTTP requests to error-triggering endpoints with unique query parameters; requests bearing Accept: text/html headers targeting the same path with incrementing or randomized query values.
• Logs: Application logs showing a rapid succession of exception stack traces with unique messages incorporating request URI or query parameter values; JVM garbage collection logs showing frequent full GC cycles with diminishing heap reclamation.
• Process: JVM process exhibiting steadily increasing heap usage over time without recovery; eventual java.lang.OutOfMemoryError: Java heap space entries in application logs or crash dumps.
• Application Behavior: Micronaut application becoming unresponsive or returning HTTP 503 errors after a period of unusual traffic to error-generating endpoints.

The fix is available in io.micronaut:micronaut-http-server version 4.10.17, which replaces the unbounded ConcurrentHashMap with a ConcurrentLinkedHashMap capped at 100 entries. Organizations should upgrade to version 4.10.17 or later as the primary remediation. As a temporary workaround, deploying a web application firewall (WAF) or rate-limiting proxy in front of the Micronaut application to restrict the rate of requests to error-generating endpoints can reduce exploitation risk. Additionally, reviewing application code to ensure exception messages do not incorporate unvalidated user input can eliminate the precondition for exploitation (Github Advisory, Release Notes).

Red Hat opened a tracking bug (BZ#2449450) for the vulnerability, indicating awareness within the enterprise Java ecosystem. The advisory was published by Micronaut maintainer sdelamo and credited to finder shblue21. No significant broader media coverage or notable researcher commentary beyond standard vulnerability database aggregation has been identified.