{"id":"CVE-2026-33013","aliases":["GHSA-43w5-mmxv-cpvh"],"url":"https://o3.security/vulnerability/CVE-2026-33013","summary":"Micronaut vulnerable to DoS via crafted form-urlencoded body binding with descending array indices","details":"Micronaut Framework is a JVM-based full stack Java framework designed for building modular, easily testable JVM applications. Versions prior to both 4.10.16 and 3.10.5 do not correctly handle descending array index order during form-urlencoded body binding in theJsonBeanPropertyBinder::expandArrayToThreshold, which allows remote attackers to cause a DoS (non-terminating loop, CPU exhaustion, and OutOfMemoryError) via crafted indexed form parameters (e.g., authors[1].name followed by authors[0].name). This issue has been fixed in versions 4.10.16 and 3.10.5.","published":"2026-03-20T04:47:42.768Z","modified":"2026-08-12T15:32:30.864741Z","cvss":null,"epss":null,"cisaKev":null,"exploitsKnown":0,"affectedPackages":[{"ecosystem":"Maven","name":"io.micronaut:micronaut-json-core","fixedVersion":"4.10.16"},{"ecosystem":"Maven","name":"io.micronaut:micronaut-json-core","fixedVersion":"3.10.5"},{"ecosystem":"Maven","name":"io.micronaut:micronaut-json-core","fixedVersion":"3.8.13"}],"fix":{"url":"https://github.com/micronaut-projects/micronaut-core/commit/1afe509677c51b320041b7a2c177366d4a4deb55","label":"micronaut-projects/micronaut-core@1afe509"},"references":[{"type":"WEB","url":"https://github.com/micronaut-projects/micronaut-core/releases/tag/v3.10.5"},{"type":"WEB","url":"https://github.com/micronaut-projects/micronaut-core/releases/tag/v4.10.16"},{"type":"ADVISORY","url":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/33xxx/CVE-2026-33013.json"},{"type":"ADVISORY","url":"https://github.com/micronaut-projects/micronaut-core/security/advisories/GHSA-43w5-mmxv-cpvh"},{"type":"ADVISORY","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-33013"},{"type":"FIX","url":"https://github.com/micronaut-projects/micronaut-core/commit/1afe509677c51b320041b7a2c177366d4a4deb55"},{"type":"FIX","url":"https://github.com/micronaut-projects/micronaut-core/pull/12410"}],"provenance":{"sources":["OSV.dev","FIRST.org (EPSS)"],"lastVerified":"2026-08-12T15:32:30.864741Z"}}