cve.bz

CVE-2026-33013

8.2 highEPSS 0.6%

High (8.2) in objectcomputing micronaut. EPSS 0.6% chance of exploitation in the next 30 days. Fixed in io.micronaut:micronaut-json-core 3.10.5, 3.8.13, 4.10.16.

Micronaut Framework is a JVM-based full stack Java framework designed for building modular, easily testable JVM applications. Versions prior to both 4.10.16 and 3.10.5 do not correctly handle descending array index order during form-urlencoded body binding in theJsonBeanPropertyBinder::expandArrayToThreshold, which allows remote attackers to cause a DoS (non-terminating loop, CPU exhaustion, and OutOfMemoryError) via crafted indexed form parameters (e.g., authors[1].name followed by authors[0].name). This issue has been fixed in versions 4.10.16 and 3.10.5.

Severity

CVSS 4.0

8.2 high
CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N

CVSS 3.1

7.5 high
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
EPSS
0.6% chance of exploitation in the next 30 days; higher than 48% of CVEs (scores of 2026-10-31)
CWE
CWE-835
Published
Modified
Record from
the NVD, synced

Affected

Packages (OSV)

AdvisoryEcosystemPackageAffectedFixed in
GHSA-43w5-mmxv-cpvhMavenio.micronaut:micronaut-json-core>=4.0.0-M1 <4.10.164.10.16
GHSA-43w5-mmxv-cpvhMavenio.micronaut:micronaut-json-core>=3.9.0 <3.10.53.10.5
GHSA-43w5-mmxv-cpvhMavenio.micronaut:micronaut-json-core<3.8.133.8.13

References

Check your stackJSON