« Volver al listado

CVE-2026-33012

Estado: AnalizadaAlta (7.5)—

Micronaut Framework is a JVM-based full stack Java framework designed for building modular, easily testable JVM applications. Versions 4.7.0 through 4.10.16 used an unbounded ConcurrentHashMap cache with no eviction policy in its DefaultHtmlErrorResponseBodyProvider. If the application throws an exception whose message may be influenced by an attacker, (for example, including request query value parameters) it could be used by remote attackers to cause an unbounded heap growth and OutOfMemoryError, leading to DoS. This issue has been fixed in version 4.10.7.

CVSS

Probabilidad de explotación (EPSS)

EPSS (Exploit Prediction Scoring System, de FIRST) estima la probabilidad de que una vulnerabilidad sea explotada en 30 días. Complementa a CVSS (impacto) y a CISA KEV (explotación confirmada).

🎯 Técnicas ATT&CK

Cómo se explota esta vulnerabilidad y qué consigue el atacante, en el lenguaje de MITRE ATT&CK.

Vector CVSS: AV:N/AC:L/PR:N/UI:N indica explotación remota sin autenticación (T1190). CWE-770 y descripción detallan DoS por agotamiento de memoria (OutOfMemoryError) explotable remotamente.

Inferido por nuestro agente de análisis a partir de la descripción oficial, el vector CVSS y la CWE, y comprobado por un supervisor. Puede contener errores.

🛡️ Mitigaciones ATT&CK que cubren estas técnicas

Filter Network TrafficVulnerability ScanningPrivileged Account ManagementNetwork SegmentationLimit Access to Resource Over NetworkApplication Isolation and Sandboxing

Tecnologías afectadas (1)

Objectcomputing — Micronaut

CWE

Referencias

JSON original (NVD)

Mostrar
{
  "id": "CVE-2026-33012",
  "cveTags": [],
  "metrics": {
    "ssvcV203": [
      {
        "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
        "ssvcData": {
          "id": "CVE-2026-33012",
          "role": "CISA Coordinator",
          "options": [
            {
              "exploitation": "none"
            },
            {
              "automatable": "yes"
            },
            {
              "technicalImpact": "partial"
            }
          ],
          "version": "2.0.3",
          "timestamp": "2026-03-20T15:59:33.202875Z"
        }
      }
    ],
    "cvssMetricV31": [
      {
        "type": "Secondary",
        "source": "security-advisories@github.com",
        "cvssData": {
          "scope": "UNCHANGED",
          "version": "3.1",
          "baseScore": 7.5,
          "attackVector": "NETWORK",
          "baseSeverity": "HIGH",
          "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
          "integrityImpact": "NONE",
          "userInteraction": "NONE",
          "attackComplexity": "LOW",
          "availabilityImpact": "HIGH",
          "privilegesRequired": "NONE",
          "confidentialityImpact": "NONE"
        },
        "impactScore": 3.6,
        "exploitabilityScore": 3.9
      }
    ]
  },
  "affected": [
    {
      "source": "security-advisories@github.com",
      "affectedData": [
        {
          "vendor": "micronaut-projects",
          "product": "micronaut-core",
          "versions": [
            {
              "status": "affected",
              "version": ">= 4.7.0, < 4.10.17"
            }
          ]
        }
      ]
    }
  ],
  "published": "2026-03-20T05:16:15.200",
  "references": [
    {
      "url": "https://github.com/micronaut-projects/micronaut-core/commit/1e2ba2c14386af3d47751732d02053a72b0b49b3",
      "tags": [
        "Patch"
      ],
      "source": "security-advisories@github.com"
    },
    {
      "url": "https://github.com/micronaut-projects/micronaut-core/releases/tag/v4.10.17",
      "tags": [
        "Release Notes"
      ],
      "source": "security-advisories@github.com"
    },
    {
      "url": "https://github.com/micronaut-projects/micronaut-core/security/advisories/GHSA-2hcp-gjrf-7fhc",
      "tags": [
        "Vendor Advisory"
      ],
      "source": "security-advisories@github.com"
    }
  ],
  "vulnStatus": "Analyzed",
  "weaknesses": [
    {
      "type": "Secondary",
      "source": "security-advisories@github.com",
      "description": [
        {
          "lang": "en",
          "value": "CWE-770"
        }
      ]
    }
  ],
  "descriptions": [
    {
      "lang": "en",
      "value": "Micronaut Framework is a JVM-based full stack Java framework designed for building modular, easily testable JVM applications.  Versions 4.7.0 through 4.10.16 used an unbounded ConcurrentHashMap cache with no eviction policy in its DefaultHtmlErrorResponseBodyProvider. If the application throws an exception whose message may be influenced by an attacker, (for example, including request query value parameters) it could be used by remote attackers to cause an unbounded heap growth and OutOfMemoryError, leading to DoS. This issue has been fixed in version 4.10.7."
    },
    {
      "lang": "es",
      "value": "Micronaut Framework es un framework Java de pila completa basado en JVM diseñado para construir aplicaciones JVM modulares y fácilmente testeables. Las versiones 4.7.0 a la 4.10.16 usaban una caché ConcurrentHashMap ilimitada sin política de desalojo en su DefaultHtmlErrorResponseBodyProvider. Si la aplicación lanza una excepción cuyo mensaje puede ser influenciado por un atacante, (por ejemplo, incluyendo parámetros de valor de consulta de solicitud) podría ser usado por atacantes remotos para causar un crecimiento de heap ilimitado y OutOfMemoryError, lo que lleva a DoS. Este problema ha sido solucionado en la versión 4.10.7."
    }
  ],
  "lastModified": "2026-06-17T10:36:46.707",
  "configurations": [
    {
      "nodes": [
        {
          "negate": false,
          "cpeMatch": [
            {
              "criteria": "cpe:2.3:a:objectcomputing:micronaut:*:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "C50C427C-305C-4A11-A5F5-E1AEB19AD09D",
              "versionEndExcluding": "4.10.17",
              "versionStartIncluding": "4.7.0"
            }
          ],
          "operator": "OR"
        }
      ]
    }
  ],
  "sourceIdentifier": "security-advisories@github.com"
}