ETK-2026-4207Zero's internal tracking ID, independent of the CVE number.

{
  "etk_id": "ETK-2026-4207",
  "cve_id": null,
  "display_id": "ETK-2026-4207",
  "ghsa_id": "GHSA-88m6-wjjg-mc7g",
  "euvd_id": null,
  "status": "published",
  "anchor_state": "awaiting_cve",
  "title": "Multipart request resource exhaustion in Micronaut HTTP server",
  "summary": "Micronaut HTTP server multipart handling can fail to complete or release buffers for malformed or hostile multipart requests. An unauthenticated client can hold connections and exhaust direct memory on routes that accept multipart data.",
  "mitigation": "Upgrade io.micronaut:micronaut-http-server-netty and io.micronaut:micronaut-http-server to version 5.2.23 or later. Until upgraded, restrict access to multipart-upload routes and enforce request-size and connection limits.",
  "vendor": "maven",
  "product": "maven:io.micronaut:micronaut-http-server-netty",
  "affected": [
    {
      "affected_notes": [],
      "affected_ranges": [
        ">= 5.0.0, < 5.2.23"
      ],
      "ecosystem": "maven",
      "fixed_versions": [
        "5.2.23"
      ],
      "package_name": "io.micronaut:micronaut-http-server-netty",
      "purl": "pkg:maven/io.micronaut/micronaut-http-server-netty"
    },
    {
      "affected_notes": [],
      "affected_ranges": [
        ">= 5.0.0, < 5.2.23"
      ],
      "ecosystem": "maven",
      "fixed_versions": [
        "5.2.23"
      ],
      "package_name": "io.micronaut:micronaut-http-server",
      "purl": "pkg:maven/io.micronaut/micronaut-http-server"
    }
  ],
  "cwes": [
    400
  ],
  "cvss_score": 7.5,
  "cvss_src": "cna_vendor",
  "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
  "epss_score": null,
  "epss_percentile": null,
  "epss_asof": null,
  "automation": "contextual",
  "check": false,
  "check_confidence_basis": null,
  "exploit": false,
  "pipeline_minutes": 31.781088433333334,
  "t0_at": null,
  "signals": {
    "trigger_signal": {
      "at": "2026-11-11T17:29:41+00:00",
      "days": -0.1389413183564815,
      "is_lower_bound": true,
      "measured_at": "2026-11-11T20:49:45.618652+00:00",
      "url": "https://github.com/micronaut-projects/micronaut-core/security/advisories/GHSA-88m6-wjjg-mc7g"
    }
  }
}