CVE-2026-33013 Micronaut vulnerable to DoS via crafted form-urlencoded body binding with descending array indices
Remote attackers can cause denial of service via CPU exhaustion and memory errors by sending crafted form-urlencoded data with descending array indices.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2026-33013?
CVE-2026-33013 is a high-severity denial of service vulnerability in micronaut-projects micronaut-core, published on 20 Mar 2026. An attacker can exploit it over the internet without logging in, with no action from the victim.
Official description
Micronaut Framework is a JVM-based full stack Java framework designed for building modular, easily testable JVM applications. Versions prior to both 4.10.16 and 3.10.5 do not correctly handle descending array index order during form-urlencoded body binding in theJsonBeanPropertyBinder::expandArrayToThreshold, which allows remote attackers to cause a DoS (non-terminating loop, CPU exhaustion, and OutOfMemoryError) via crafted indexed form parameters (e.g., authors[1].name followed by authors[0].name). This issue has been fixed in versions 4.10.16 and 3.10.5.
Weakness: CWE-835
Which versions are affected by CVE-2026-33013?
6 open source packages ship an affected version, including io.micronaut:micronaut-json-core. It affects 1 product.
| Package | Affected | Fixed in |
|---|---|---|
io.micronaut:micronaut-json-core Maven | All versions | 3.8.13 |
io.micronaut:micronaut-json-core Maven | All versions | 3.8.13 |
io.micronaut:micronaut-json-core Maven | From 3.9.0 | 3.10.5 |
io.micronaut:micronaut-json-core Maven | From 3.9.0 | 3.10.5 |
io.micronaut:micronaut-json-core Maven | From 4.0.0-M1 | 4.10.16 |
io.micronaut:micronaut-json-core Maven | From 4.0.0-M1 | 4.10.16 |
Products include Objectcomputing Micronaut.
How do I fix CVE-2026-33013?
Upgrade io.micronaut:micronaut-json-core to a fixed version for your release line: 3.8.13, 3.10.5 or 4.10.16.
Upgrade, then put limits on request size, rate and nesting depth so one client cannot exhaust the service. More about Denial of service.
Is CVE-2026-33013 being exploited?
It is not confirmed as exploited in the wild, but public exploit code for CVE-2026-33013 exists.
Other vulnerabilities in micronaut-projects micronaut-core
- CVE-2020-7611 Micronaut's HTTP client is vulnerable to HTTP Request Header Injection
- CVE-2026-33012 Micronaut Framework vulnerable to a Denial of Service in HTML error response caching
- CVE-2021-32769 Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') in micronaut-core
- CVE-2022-21700 Memory leak in micronaut-core
- CVE-2024-23639 micronaut-core management endpoints vulnerable to drive-by localhost attack
Sources
Also known as CLEANSTART-2026-OE40896, CLSA-2026-1787664048, CLSA-2026-1788443284, GHSA-43w5-mmxv-cpvh, MINI-gx69-56rx-7wg6.