CVE-2023-46131 Grails® data binding causes JVM crash and/or DoS

What is CVE-2023-46131?

CVE-2023-46131 is a medium-severity denial of service vulnerability in grails-core, published on 20 Dec 2023. Any signed-in user can exploit it over the network, with no action from the victim.

Official description

Grails is a framework used to build web applications with the Groovy programming language. A specially crafted web request can lead to a JVM crash or denial of service. Any Grails framework application using Grails data binding is vulnerable. This issue has been patched in version 3.3.17, 4.1.3, 5.3.4, 6.1.0.

Weakness: CWE-400

Which versions are affected by CVE-2023-46131?

8 open source packages ship an affected version, including org.grails:grails-databinding. It affects 1 product.

Products include Grails Grails.

How do I fix CVE-2023-46131?

Upgrade org.grails:grails-databinding to a fixed version for your release line: 3.3.17, 4.1.3, 5.3.4 or 6.1.0.

Upgrade, then put limits on request size, rate and nesting depth so one client cannot exhaust the service. More about Denial of service.

Is CVE-2023-46131 being exploited?

There is no known exploitation of CVE-2023-46131 in the wild and no public exploit code.

Other vulnerabilities in grails-core

• CVE-2022-35912 Grails framework Remote Code Execution via Data Binding Critical 9.8
• CVE-2019-12728 Incorrect Resource Transfer Between Spheres in Grails High 8.1

Sources

• CVE record
• NVD
• OSV
• GitHub advisory
• How this page is made

Also known as CLSA-2026-1784077496, GHSA-3pjv-r7w4-2cf5.