Skip to content
Patch Next
Sign inAdd to your agent

← Public intelligence

Maven package

io.micronaut:micronaut-json-core

Open actionable advisories and recorded vendor fixes. This public package view has no inventory attached and cannot establish whether your deployment is affected. A vendor fix never resolves your finding; verify your installed version and the source guidance.

Open advisories

1 actionable advisory, newest first. Withdrawn advisories and news are excluded. Coverage is partial.

  1. High, CVSS 8.2MavenPublished

    Micronaut vulnerable to DoS via crafted form-urlencoded body binding with descending array indices

    CVE-2026-33013 · GHSA-43w5-mmxv-cpvh

    Affected
    • Maven io.micronaut:micronaut-json-core >= 4.0.0-M1, < 4.10.16; >= 3.9.0, < 3.10.5; < 3.8.13
    Fixed in
    3.8.133.10.54.10.16· Vendor fix available
    Issue
    In JsonBeanPropertyBinder::expandArrayToThreshold in io.micronaut:micronaut-json-core before Micronaut 4 4.10.16 and in Micronaut 3 before 3.10.5 does not correctly handle descending array index order during form-urlencoded body binding, which allows remote attackers to cause a denial of service (non-terminating loop, CPU exhaustion, and OutOfMemoryError) via crafted indexed form parameters (e.g., authors[1].name followed by authors[0].name). Example With such an application Sending curl -v -X POST 'http://127.0.0.1:8080/submit' -H 'Content-Type: application/x-www-form-urlencoded' --data-urlencode 'authors[1].name=RobertGalbraith' --data-urlencode 'authors[0].name=JKRowling' causes sustained CPU usage and unbounded memory growth (eventually OutOfMemoryError). Patches For Micronaut 4, the problem has been patched in micronaut-core, dependencies with group id io.micronaut, since 4.10.16. For Micronaut 3, the problem has been patched since 3.10.5 Users upgrade to the latest version of…

    Recommended action: Upgrade to 4.10.16, 3.10.5 or 3.8.13 by release line, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.

    Sources:github.comSource checked Evidence →