Micronaut Framework is a JVM‑based full‑stack framework for building modular Java applications. From version 4.3.0 up to, but excluding, 4.10.22 – and likewise for 3.10.0 through 3.10.5 and 3.8.0 through 3.8.13 – the TimeConverterRegistrar maintains an unbounded ConcurrentHashMap that stores DateTimeFormatter instances. The key used for the cache combines an @Format annotation pattern with the locale extracted from an HTTP Accept‑Language header. Because the Locale.forLanguageTag method accepts arbitrary BCP‑47 private‑use extensions, an unauthenticated attacker can send crafted Accept‑Language headers that create an unbounded number of unique cache keys. The growing cache eventually consumes all available JVM heap memory, leading the application to crash and causing a denial‑of‑service. The flaw is remedied in release 4.10.22, 3.10.6, and 3.8.14.

affected. Versions from 4.3.0 through 4.10.21, as well as 3.10.0 through 3.10.5 and 3.8.0 through 3.8.13, contain the unbounded cache. Updating to the fixed releases 4.10.22, 3.10.6 or 3.8.14 resolves the issue. No other vendor or product versions are known to be impacted.

The CVSS score of 7.5 indicates a high severity. The EPSS score of <1% indicates a very low historical likelihood of exploitation, yet the vulnerability is publicly known and can be triggered via a simple HTTP header. The flaw is not listed in the CISA KEV catalog. Attackers can exploit it remotely and unauthenticated by sending crafted Accept‑Language headers with private‑use extensions, so the attack vector is network‑based and requires no special privileges.