CVE-2026-33013: Micronaut vulnerable to DoS via crafted form-urlencoded body binding with descending array indices
(updated )
In JsonBeanPropertyBinder::expandArrayToThreshold in io.micronaut:micronaut-json-core before Micronaut 4 4.10.16 and in Micronaut 3 before 3.10.5 does not correctly handle descending array index order during form-urlencoded body binding, which allows remote attackers to cause a denial of service (non-terminating loop, CPU exhaustion, and OutOfMemoryError) via crafted indexed form parameters (e.g., authors[1].name followed by authors[0].name).
References
- github.com/advisories/GHSA-43w5-mmxv-cpvh
- github.com/micronaut-projects/micronaut-core
- github.com/micronaut-projects/micronaut-core/commit/1afe509677c51b320041b7a2c177366d4a4deb55
- github.com/micronaut-projects/micronaut-core/pull/12410
- github.com/micronaut-projects/micronaut-core/releases/tag/v3.10.5
- github.com/micronaut-projects/micronaut-core/releases/tag/v4.10.16
- github.com/micronaut-projects/micronaut-core/security/advisories/GHSA-43w5-mmxv-cpvh
- nvd.nist.gov/vuln/detail/CVE-2026-33013
Code Behaviors & Features
Detect and mitigate CVE-2026-33013 with GitLab Dependency Scanning
Secure your software supply chain by verifying that all open source dependencies used in your projects contain no disclosed vulnerabilities. Dependency Scanning using SBOM also detects vulnerabilities from proprietary advisories that this site does not include. Learn more about Dependency Scanning using SBOM →