CVE-2023-46131: Uncontrolled Resource Consumption
(updated )
Grails is a framework used to build web applications with the Groovy programming language. A specially crafted web request can lead to a JVM crash or denial of service. Any Grails framework application using Grails data binding is vulnerable. This issue has been patched in version 3.3.17, 4.1.3, 5.3.4, 6.1.0.
References
- github.com/advisories/GHSA-3pjv-r7w4-2cf5
- github.com/grails/grails-core/commit/74326bdd2cf7dcb594092165e9464520f8366c60
- github.com/grails/grails-core/commit/c401faaa6c24c021c758b95f72304a0e855a8db3
- github.com/grails/grails-core/issues/13302
- github.com/grails/grails-core/security/advisories/GHSA-3pjv-r7w4-2cf5
- grails.org/blog/2023-12-20-cve-data-binding-dos.html
- nvd.nist.gov/vuln/detail/CVE-2023-46131
Code Behaviors & Features
Detect and mitigate CVE-2023-46131 with GitLab Dependency Scanning
Secure your software supply chain by verifying that all open source dependencies used in your projects contain no disclosed vulnerabilities. Dependency Scanning using SBOM also detects vulnerabilities from proprietary advisories that this site does not include. Learn more about Dependency Scanning using SBOM →