Micronaut Framework is a JVM‑based full‑stack Java framework for building modular, easily testable applications. The vulnerability lies in the DateTimeFormatter cache within the TimeConverterRegistrar. The cache, a ConcurrentHashMap keyed by a combination of the @Format pattern and the locale extracted from the HTTP Accept‑Language header, is unbounded. Because Locale.forLanguageTag accepts arbitrary BCP 47 private‑use extensions (e.g., en‑x‑a001, en‑x‑a002), an unauthenticated attacker can send a unique locale tag with each request, forcing the cache to grow indefinitely, consuming heap space until the JVM crashes. The result is a denial‑of‑service without requiring authentication or elevated privileges.

Micronaut Framework (Micronaut Core component) is affected. Versions from 4.3.0 through 4.10.21, as well as 3.10.0 through 3.10.5 and 3.8.0 through 3.8.13, contain the unbounded cache. Updating to the fixed releases 4.10.22, 3.10.6, or 3.8.14 resolves the issue. No other vendor or product versions are known to be impacted.

The CVSS score of 7.5 indicates a high severity. The EPSS score of <1% indicates a very low historical likelihood of exploitation, yet the vulnerability is publicly known and can be triggered via a simple HTTP header. The flaw is not listed in the CISA KEV catalog. Attackers can exploit it remotely and unauthenticated by sending crafted Accept‑Language headers with private‑use extensions, so the attack vector is network‑based and requires no special privileges.