PT-2026-26180 · Io+1 · Micronaut-Json-Core+1
Shblue21
·
Published
2026-03-17
·
Updated
2026-03-20
·
CVE-2026-33013
CVSS v4.0
8.2
High
| Vector | AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N |
Name of the Vulnerable Software and Affected Versions
Micronaut Framework versions prior to 4.10.16 and prior to 3.10.5
Description
The Micronaut Framework does not handle descending array index order correctly during form-urlencoded body binding within the
JsonBeanPropertyBinder::expandArrayToThreshold function. This can allow a remote attacker to cause a denial of service (DoS) condition, characterized by a non-terminating loop, CPU exhaustion, and an OutOfMemoryError. The issue occurs when crafted indexed form parameters are submitted, such as authors[1].name followed by authors[0].name. The affected component is io.micronaut:micronaut-json-core. Submitting a POST request with manipulated form parameters can lead to sustained CPU usage and unbounded memory growth.Recommendations
Versions prior to 4.10.16 must be upgraded to version 4.10.16 or later.
Versions prior to 3.10.5 must be upgraded to version 3.10.5 or later.
Exploit
Fix
Infinite Loop
Found an issue in the description? Have something to add? Feel free to write us 👾
Weakness Enumeration
Related Identifiers
Affected Products
Micronaut Framework
Micronaut-Json-Core