CVE-2026-33013

Micronaut vulnerable to DoS via crafted form-urlencoded body binding with descending array indices

View on CVE.org
Published Mar 20, 2026 CVSS 4.0 · 8.2 High EPSS < 1% KEV · Not listed
Description
Micronaut Framework is a JVM-based full stack Java framework designed for building modular, easily testable JVM applications. Versions prior to both 4.10.16 and 3.10.5 do not correctly handle descending array index order during form-urlencoded body binding in theJsonBeanPropertyBinder::expandArrayToThreshold, which allows remote attackers to cause a DoS (non-terminating loop, CPU exhaustion, and OutOfMemoryError) via crafted indexed form parameters (e.g., authors[1].name followed by authors[0].name). This issue has been fixed in versions 4.10.16 and 3.10.5.

Analysis

AI-generated

Technical impact

Micronaut Framework contains a flaw in its body binder that incorrectly processes descending array indices in form-urlencoded requests. When an attacker supplies indexed parameters such as authors[1].name followed by authors[0].name, the binder enters a non‑terminating loop, exhausting CPU and eventually raising an OutOfMemoryError. This weakness maps to CWE-1285 (Unvalidated Loop Index) and CWE-835 (Infinite Loop).

Affected Systems

All releases of Micronaut Core older than 4.10.16 and 3.10.5 are affected. Any application built with Micronaut projects using the Core framework for request parsing and accepting user‑supplied form data is vulnerable if it remains on an older version.

Risk and Exploitability

The CVSS score of 8.2 indicates high severity, but the EPSS score is under 1%, suggesting limited exploit prevalence to date. The vulnerability is not listed in CISA’s KEV catalog. The attack vector is remote: a single crafted HTTP POST request is sufficient to trigger the denial of service. Because the exploit does not require elevated privileges or additional access, administrators should prioritize updating the framework before considering temporary mitigations.

Remediation

No solution or workaround provided in the CVE record.

OpenCVE Recommended Actions

  • Upgrade Micronaut Core to version 4.10.16 or 3.10.5 or later
  • Verify that all application instances are running the patched version
  • If upgrading cannot be performed immediately, implement request validation to disallow indexed array parameters in form-urlencoded bodies as a temporary measure

Generated by OpenCVE AI on March 24, 2026 at 22:26 UTC.

Tracking

Sign in to view the affected projects.

Advisories

Source ID Title
Github GHSA Github GHSA GHSA-43w5-mmxv-cpvh Micronaut vulnerable to DoS via crafted form-urlencoded body binding with descending array indices
History
Type Values Removed Values Added
Metrics ssvc

{'options': {'Automatable': 'yes', 'Exploitation': 'poc', 'Technical Impact': 'partial'}, 'version': '2.0.3'}
Type Values Removed Values Added
First Time appeared Objectcomputing
Objectcomputing micronaut
CPEs cpe:2.3:a:objectcomputing:micronaut:*:*:*:*:*:*:*:*
Vendors & Products Objectcomputing
Objectcomputing micronaut
Metrics cvssV3_1

{'score': 6.5, 'vector': 'CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H'}

 cvssV3_1

{'score': 7.5, 'vector': 'CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H'}
Type Values Removed Values Added
Weaknesses CWE-1285
References
Metrics threat_severity

None

 cvssV3_1

{'score': 6.5, 'vector': 'CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H'}

threat_severity

Moderate
Type Values Removed Values Added
First Time appeared Micronaut-projects
Micronaut-projects micronaut-core
Vendors & Products Micronaut-projects
Micronaut-projects micronaut-core
Type Values Removed Values Added
Description Micronaut Framework is a JVM-based full stack Java framework designed for building modular, easily testable JVM applications. Versions prior to both 4.10.16 and 3.10.5 do not correctly handle descending array index order during form-urlencoded body binding in theJsonBeanPropertyBinder::expandArrayToThreshold, which allows remote attackers to cause a DoS (non-terminating loop, CPU exhaustion, and OutOfMemoryError) via crafted indexed form parameters (e.g., authors[1].name followed by authors[0].name). This issue has been fixed in versions 4.10.16 and 3.10.5.
Title Micronaut vulnerable to DoS via crafted form-urlencoded body binding with descending array indices
Weaknesses CWE-835
References
Metrics cvssV4_0

{'score': 8.2, 'vector': 'CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N'}
Weaknesses
  • CWE-1285

    Improper Validation of Specified Index, Position, or Offset in Input

  • CWE-835

    Loop with Unreachable Exit Condition ('Infinite Loop')

Sources

Status
PUBLISHED
Assigner
GitHub_M
Published
Updated
Mar 25, 2026, 2:23 PM
Reserved
Mar 17, 2026, 5:22 PM

View source JSON

Updated
Mar 25, 2026, 2:23 PM

JSON

Status
Analyzed
Published
Mar 20, 2026, 5:16 AM
Modified
Jun 17, 2026, 10:36 AM

View source JSON

Severity
Moderate
Public date
Mar 20, 2026, 4:47 AM

View source Bugzilla JSON

Updated
Mar 25, 2026, 2:09 PM

JSON