[GHSA-3rfq-4wpf-qqw3] Micronaut has Unbounded bundleCache in ResourceBundleMessageSource that Allows Memory Exhaustion via Accept-Language Header

[jojojo8359]

Updates

• Affected products
• References

Comments
This vulnerability was also fixed in the latest 3.10.x release, but is not indicated in the advisory - see the 3.10.6 release notes.

[github]

Hi there @sdelamo! A community member has suggested an improvement to your security advisory. If approved, this change will affect the global advisory listed at github.com/advisories. It will not affect the version listed in your project repository.

This change will be reviewed by our Security Curation Team. If you have thoughts or feedback, please share them in a comment here! If this PR has already been closed, you can start a new community contribution for this advisory

[Copilot]

Pull request overview

Adds the 3.10.x affected range (fixed in 3.10.6) and corresponding release-notes reference to the GHSA-3rfq-4wpf-qqw3 advisory for Micronaut's ResourceBundleMessageSource memory exhaustion vulnerability.

Changes:

• Add new affected package range for io.micronaut:micronaut-inject fixed in 3.10.6
• Add WEB reference link to the v3.10.6 release notes
• Bump modified timestamp

---

💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.