VULNERABILITY INTELLIGENCE
CVE-2026-33013
CVSS score7.5 HIGH
EPSS probability0.60%
CISA KEVNot currently listed
Published2026-03-20
Last modified2026-06-17
CVSS vectorCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Description
Micronaut Framework is a JVM-based full stack Java framework designed for building modular, easily testable JVM applications. Versions prior to both 4.10.16 and 3.10.5 do not correctly handle descending array index order during form-urlencoded body binding in theJsonBeanPropertyBinder::expandArrayToThreshold, which allows remote attackers to cause a DoS (non-terminating loop, CPU exhaustion, and OutOfMemoryError) via crafted indexed form parameters (e.g., authors[1].name followed by authors[0].name). This issue has been fixed in versions 4.10.16 and 3.10.5.
Weakness classification
- security-advisories@github.com: CWE-835
Primary references
- security-advisories@github.com — Patch
- security-advisories@github.com — Issue Tracking
- security-advisories@github.com — Release Notes
- security-advisories@github.com — Release Notes
- security-advisories@github.com — Exploit, Patch, Vendor Advisory