CVE-2026-33012

CVE-2026-33012 impacts Micronaut Framework versions 4.7.0 through 4.10.16, where an unbounded cache in its DefaultHtmlErrorResponseBodyProvider can be exploited if error messages incorporate attacker-controlled input. This High severity vulnerability, with a CVSS score of 7.5, allows remote, unauthenticated attackers to cause a Denial of Service by triggering an OutOfMemoryError through unbounded heap growth. The attack vector is network-based with low complexity and no user interaction required. Currently, there is no evidence of active exploitation, no public exploit code available in common databases like Metasploit or ExploitDB, and community discussion remains minimal.