An unbounded ConcurrentHashMap was used in the DefaultHtmlErrorResponseBodyProvider of Micronaut Framework versions 4.7.0 to 4.10.16. When an exception occurs and its message can be influenced by an attacker—such as by including data from request query parameters—the framework will repeatedly store these messages in the map. Because the map has no eviction policy, it will grow without bound until the JVM runs out of memory, resulting in an OutOfMemoryError that crashes the application and denies service to legitimate users. This weakness is a classic memory allocation issue, classified as CWE‑770.

The vulnerability affects the Micronaut Framework open‑source library, specifically micronaut-core from versions 4.7.0 through 4.10.16. The fix was introduced in version 4.10.7 and is included in later releases such as 4.10.17. Any project that incorporates a vulnerable Micronaut core package and allows unfiltered exception messages exposed to external input is potentially impacted.

The CVSS base score is 7.5, indicating a high severity. The EPSS score is below 1%, suggesting that exploitation is unlikely but still possible. The flaw is not listed in CISA’s KEV catalog. An attacker can trigger the denial of service remotely by crafting HTTP requests that cause an exception whose message contains attacker‑controlled data, leading the application to grow its internal cache until memory exhaustion. The exploitation prerequisites are minimal—access to the public interface that can provoke such an exception and the ability to observe the resulting OutOfMemoryError via resource unavailability or application crash logs.