Micronaut Framework contains a flaw in its body binder that incorrectly processes descending array indices in form-urlencoded requests. When an attacker supplies indexed parameters such as authors[1].name followed by authors[0].name, the binder enters a non‑terminating loop, exhausting CPU and eventually raising an OutOfMemoryError. This weakness maps to CWE-1285 (Unvalidated Loop Index) and CWE-835 (Infinite Loop).

All releases of Micronaut Core older than 4.10.16 and 3.10.5 are affected. Any application built with Micronaut projects using the Core framework for request parsing and accepting user‑supplied form data is vulnerable if it remains on an older version.

The CVSS score of 8.2 indicates high severity, but the EPSS score is under 1%, suggesting limited exploit prevalence to date. The vulnerability is not listed in CISA’s KEV catalog. The attack vector is remote: a single crafted HTTP POST request is sufficient to trigger the denial of service. Because the exploit does not require elevated privileges or additional access, administrators should prioritize updating the framework before considering temporary mitigations.