TI-2026-25460 Aliases CVE-2026-33013 GHSA-43w5-mmxv-cpvh

Micronaut vulnerable to DoS via crafted form-urlencoded body binding with descending array indices

HIGH 75CWE-835Published 2026-03-20 · Updated 2026-03-25

Key facts

Attack vector: Network
Privileges required: None
User interaction: None
Attack complexity: Low
Attack requirements: Present
Impact type: Denial of service
Confidentiality · integrity · availability: None · None · High
Fix status: Partial Red Hat: 1 without a fix

Attack profile from CVSS 4.0 · CNA. Fix status from CNA, GitHub and Red Hat. Impact type from CWE-835.

Summary

Micronaut Framework is a JVM-based full stack Java framework designed for building modular, easily testable JVM applications. Versions prior to both 4.10.16 and 3.10.5 do not correctly handle descending array index order during form-urlencoded body binding in theJsonBeanPropertyBinder::expandArrayToThreshold, which allows remote attackers to cause a DoS (non-terminating loop, CPU exhaustion, and OutOfMemoryError) via crafted indexed form parameters (e.g., authors[1].name followed by authors[0].name). This issue has been fixed in versions 4.10.16 and 3.10.5.

Why it matters now

Exploitation Proof of concept CISA SSVC · not in CISA KEV

EPSS 0.00619 49th percentileScored 2026-11-07

Public exploit Yes 1 exploit referenceTagged by NVD

Fix Partial micronaut-core (micronaut-projects): 4.10.16, 3.10.5io.micronaut:micronaut-json-core (Maven): 4.10.16, 3.10.5, 3.8.13Red Hat: 1 without a fix

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation: Poc
Automatable: Yes
Technical impact: Partial

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

Vendor	Product	Affected versions	Fixed in	Status	Source
micronaut-projects	micronaut-core	4.0.0-M1 to before 4.10.16; before 3.10.5	4.10.16, 3.10.5	Patch available	CNA
—	io.micronaut:micronaut-json-core (Maven)	4.0.0-M1 to before 4.10.16	4.10.16	Patch available	GHSA-43w5-mmxv-cpvh
—	io.micronaut:micronaut-json-core (Maven)	3.9.0 to before 3.10.5	3.10.5	Patch available	GHSA-43w5-mmxv-cpvh
—	io.micronaut:micronaut-json-core (Maven)	before 3.8.13	3.8.13	Patch available	GHSA-43w5-mmxv-cpvh

micronaut-core Vendormicronaut-projects Affected 4.0.0-M1 to before 4.10.16; before 3.10.5 Fixed in 4.10.16, 3.10.5 Patch available CNA
io.micronaut:micronaut-json-core (Maven) Vendor— Affected 4.0.0-M1 to before 4.10.16 Fixed in 4.10.16 Patch available GHSA-43w5-mmxv-cpvh
io.micronaut:micronaut-json-core (Maven) Vendor— Affected 3.9.0 to before 3.10.5 Fixed in 3.10.5 Patch available GHSA-43w5-mmxv-cpvh
io.micronaut:micronaut-json-core (Maven) Vendor— Affected before 3.8.13 Fixed in 3.8.13 Patch available GHSA-43w5-mmxv-cpvh

CPE configurations NVD · 1

CPE	Versions	Role	Vendor
cpe:2.3:a:objectcomputing:micronaut::::::::	before 3.10.5; 4.0.0 to before 4.10.16	Vulnerable	micronaut-projects

cpe:2.3:a:objectcomputing:micronaut:*:*:*:*:*:*:*:* Versions before 3.10.5; 4.0.0 to before 4.10.16 Vulnerable ·micronaut-projects

Remediation

Fix · CNA micronaut-core (micronaut-projects) Fixed in 4.10.16, 3.10.5
Fix · GHSA-43w5-mmxv-cpvh io.micronaut:micronaut-json-core (Maven) Fixed in 4.10.16 Advisory →
Fix · GHSA-43w5-mmxv-cpvh io.micronaut:micronaut-json-core (Maven) Fixed in 3.10.5 Advisory →
Fix · GHSA-43w5-mmxv-cpvh io.micronaut:micronaut-json-core (Maven) Fixed in 3.8.13 Advisory →

Vendor assessments

Red Hat

Red Hat rating: Moderate. Red Hat's page for this CVE →

Product	Status	Plan or fix
Red Hat Fuse 7	Affected	No fix planned: Out of support scope

Not affected: 3 products

Red Hat JBoss Enterprise Application Platform 8
Red Hat JBoss Enterprise Application Platform Expansion Pack
Red Hat build of Apache Camel for Spring Boot 4

Timeline

2026-10-02 Threatist record created from CVE-2026-33013
2026-10-03 Alias added: GHSA-43w5-mmxv-cpvh
2026-10-25 EPSS moved to the below the 50th percentile

References

Other 4

TI-2020-06133 All versions of io.micronaut:micronaut-http-client before 1.2.11 and all versions from… CVSS 3.1CRITICAL 9.8
TI-2026-25459 Micronaut Framework vulnerable to a Denial of Service in HTML error response caching CVSS 3.1HIGH 7.5
TI-2021-12436 Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') in micronaut-core CVSS 3.1HIGH 7.5
TI-2024-15658 micronaut-core management endpoints vulnerable to drive-by localhost attack CVSS 3.1HIGH 7.8
TI-2022-06076 Memory leak in micronaut-core CVSS 3.1MEDIUM 5.3

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences