The vulnerability is a memory exhaustion flaw that allows an attacker to fill an unbounded cache within the Micronaut Core framework. The cache, a ConcurrentHashMap that stores DateTimeFormatter instances keyed by a format pattern and a locale derived from the HTTP Accept‑Language header, can grow without bound. By sending requests with unique, private‑use language tags, an unauthenticated attacker can create arbitrary cache keys until the JVM heap is exhausted, resulting in an out‑of‑memory error and a crash of the application. The impact is a denial of service that can render the affected service unavailable to legitimate users.

Micronaut Framework (Micronaut Core component) is affected. Versions from 4.3.0 up to and including 4.10.21 contain the unbounded cache. Updating to version 4.10.22 or later resolves the issue. No other vendor or product versions are known to be impacted.

The CVSS score of 7.5 indicates a high severity. The EPSS score is not available, so the historical likelihood of exploitation is unknown, but the vulnerability is publicly known and can be triggered via a simple HTTP header. The flaw is not listed in the CISA KEV catalog. Attackers can exploit it remotely and unauthenticated by sending crafted Accept‑Language headers with private‑use extensions, so the attack vector is network‑based and requires no special privileges.