A vulnerability in the Micronaut Framework allows unauthenticated remote attackers to trigger a denial of service condition through uncontrolled memory consumption.

This is a resource exhaustion vulnerability (CWE-770) occurring within the DefaultHtmlErrorResponseBodyProvider. The component uses an unbounded cache that can be manipulated by an unauthenticated attacker to cause OutOfMemory errors.

The vulnerability carries a CVSS score of 7.5, indicating a high risk of service disruption. Successful exploitation results in a denial of service, which can lead to significant operational downtime, loss of availability for critical business applications, and potential disruption of dependent services.

Immediate Action: Update the affected Micronaut project dependencies to version 4.10.17 or later to implement the required cache eviction policies.

Proactive Monitoring: Monitor JVM heap usage metrics and application error logs for signs of memory exhaustion or unusually high frequencies of exception-related HTTP responses.

Compensating Controls: Deploy a Web Application Firewall (WAF) to filter or rate-limit requests that contain excessively large or malicious input parameters designed to trigger application exceptions.

Public Exploit Available: Unknown

Given the ease of exploitation and the potential for complete service interruption, administrators should prioritize updating the Micronaut framework to version 4.10.17. While no active exploitation is currently confirmed, the nature of this denial of service vulnerability makes it a prime candidate for automated scanning and abuse. Failure to patch leaves the application infrastructure susceptible to stability issues caused by malicious request injection.