Grails® data binding causes JVM crash and/or DoS
Priority LOW 34CWE-400Published · Updated
Key facts
- Attack vector
- Network
- Privileges required
- None
- User interaction
- None
- Attack complexity
- Low
- Impact type
- Denial of service
- Confidentiality · integrity · availability
- None · None · High
- Fix status
- Fixed
Attack profile from CVSS 3.1 · NVD. Fix status from CNA and GitHub. Impact type from CWE-400.
Summary
Grails is a framework used to build web applications with the Groovy programming language. A specially crafted web request can lead to a JVM crash or denial of service. Any Grails framework application using Grails data binding is vulnerable. This issue has been patched in version 3.3.17, 4.1.3, 5.3.4, 6.1.0.
Why it matters now
EPSS 0.00722 54th percentileScored 2026-11-07
Fix Fixed grails-core (grails): 6.1.0, 5.3.4, 4.1.3 +1org.grails:grails-databinding (Maven): 6.1.0, 5.3.4, 4.1.3 +1
SSVC decision points
Not available: CISA has not published SSVC decision points for this record.
Affected products
| Vendor | Product | Affected versions | Fixed in | Status | Source |
|---|---|---|---|---|---|
| grails | grails-core | 6.0.0 to before 6.1.0; 5.0.0 to before 5.3.4; 4.0.0 to before 4.1.3; 2.0.0 to before 3.3.17 | 6.1.0, 5.3.4, 4.1.3, 3.3.17 | Patch available | CNA |
| — | org.grails:grails-databinding (Maven) | 6.0.0 to before 6.1.0 | 6.1.0 | Patch available | GHSA-3pjv-r7w4-2cf5 |
| — | org.grails:grails-databinding (Maven) | 5.0.0 to before 5.3.4 | 5.3.4 | Patch available | GHSA-3pjv-r7w4-2cf5 |
| — | org.grails:grails-databinding (Maven) | 4.0.0 to before 4.1.3 | 4.1.3 | Patch available | GHSA-3pjv-r7w4-2cf5 |
| — | org.grails:grails-databinding (Maven) | 2.0.0 to before 3.3.17 | 3.3.17 | Patch available | GHSA-3pjv-r7w4-2cf5 |
- grails-core Vendorgrails Affected 6.0.0 to before 6.1.0; 5.0.0 to before 5.3.4; 4.0.0 to before 4.1.3; 2.0.0 to before 3.3.17 Fixed in 6.1.0, 5.3.4, 4.1.3, 3.3.17 Patch available CNA
- org.grails:grails-databinding (Maven) Vendor— Affected 6.0.0 to before 6.1.0 Fixed in 6.1.0 Patch available GHSA-3pjv-r7w4-2cf5
- org.grails:grails-databinding (Maven) Vendor— Affected 5.0.0 to before 5.3.4 Fixed in 5.3.4 Patch available GHSA-3pjv-r7w4-2cf5
- org.grails:grails-databinding (Maven) Vendor— Affected 4.0.0 to before 4.1.3 Fixed in 4.1.3 Patch available GHSA-3pjv-r7w4-2cf5
- org.grails:grails-databinding (Maven) Vendor— Affected 2.0.0 to before 3.3.17 Fixed in 3.3.17 Patch available GHSA-3pjv-r7w4-2cf5
CPE configurations NVD · 1
| CPE | Versions | Role | Vendor |
|---|---|---|---|
| cpe:2.3:a:grails:grails:*:*:*:*:*:*:*:* | before 3.3.17; 4.0.0 to before 4.1.3; 5.0.0 to before 5.3.4; 6.0.0 to before 6.1.0 | Vulnerable | grails |
- cpe:2.3:a:grails:grails:*:*:*:*:*:*:*:* Versions before 3.3.17; 4.0.0 to before 4.1.3; 5.0.0 to before 5.3.4; 6.0.0 to before 6.1.0 Vulnerable ·grails
Remediation
- Fix · CNA grails-core (grails) Fixed in 6.1.0, 5.3.4, 4.1.3, 3.3.17
- Fix · GHSA-3pjv-r7w4-2cf5 org.grails:grails-databinding (Maven) Fixed in 6.1.0 Advisory →
- Fix · GHSA-3pjv-r7w4-2cf5 org.grails:grails-databinding (Maven) Fixed in 5.3.4 Advisory →
- Fix · GHSA-3pjv-r7w4-2cf5 org.grails:grails-databinding (Maven) Fixed in 4.1.3 Advisory →
- Fix · GHSA-3pjv-r7w4-2cf5 org.grails:grails-databinding (Maven) Fixed in 3.3.17 Advisory →
Timeline
- 2026-10-02 Threatist record created from CVE-2023-46131
- 2026-10-03 Alias added: GHSA-3pjv-r7w4-2cf5
References
Patch 2
Advisory 3
More Grails vulnerabilities
- TI-2022-16339 In grails-databinding in Grails before 3.3.15, 4.x before 4.1.1, 5.x before 5.1.9, and… CVSS 3.1CRITICAL 9.8
- TI-2019-09520 Grails before 3.3.10 used cleartext HTTP to resolve the SDKMan notification service. CVSS 3.1HIGH 8.1
Sources
- CVE-2023-46131 · CVE Program
- CVE-2023-46131 · NVD
- FIRST EPSS
- GHSA-3pjv-r7w4-2cf5 · GitHub Advisory Database · CC BY 4.0
This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences