Predictive Vulnerability Intelligence.

Product

  • Product
  • Pricing
  • Documentation

Company

  • About
  • Partnerships
  • Blog
  • Support

Legal

  • Terms
  • Privacy
  • Data Licensing

© 2026 FAUCET Technologies LLC. All rights reserved.

CVE-2026-33013

24
FAUCET Score

CVE-2026-33013 is a high-severity Denial of Service (DoS) vulnerability impacting Micronaut Framework versions prior to 4.10.16 and 3.10.5. The flaw lies in the incorrect handling of descending array index order during form-urlencoded body binding, specifically within the JsonBeanPropertyBinder::expandArrayToThreshold function. An unauthenticated remote attacker can exploit this by sending crafted indexed form parameters, leading to a non-terminating loop, CPU exhaustion, and OutOfMemoryError. With a CVSS score of 7.5, the attack vector is network-based with low complexity. Currently, there is no evidence of active exploitation, public exploit code, or significant community discussion regarding this vulnerability.

Impacted Technologies

VendorProductVersion(s)CPE
< 3.10.5CPE matchmatch criteria
cpe:2.3:a:objectcomputing:micronaut:*:*:*:*:*:*:*:*
>= 4.0.0, < 4.10.16CPE matchmatch criteria
cpe:2.3:a:objectcomputing:micronaut:*:*:*:*:*:*:*:*

CVSS Data

CVSS version used by this source: 4.0

8.2HIGH

CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

Attack Vector
NETWORK
Attack Complexity
LOW
Attack Requirements
PRESENT
Privileges Required
NONE
User Interaction
NONE
VS Confidentiality
NONE
VS Integrity
NONE
VS Availability
HIGH
SS Confidentiality
NONE
SS Integrity
NONE
SS Availability
NONE
Exploit Maturity
NOT_DEFINED
CvssVersion
4.0

Exploit Intelligence

EPSS Score
0.60%
Probability of exploitation in next 30 days
EPSS Percentile
44.9%
Percentile rank of EPSS score among Peer Group
As of 2026-07-27
Model: v2026.06.15
This CVE's current EPSS score of 0.0060 is in the 22nd percentile among its peer group of 51,506 CVEs.

Social Chatter

The average CVE in this peer group has 0.0 Twitter, 0.0 Reddit, 0.1 Bluesky, 0.1 Mastodon, and 0.4 GitHub mentions.

Media Mentions

No media coverage found for this CVE.

The average CVE in this peer group has 0.1 InfoSec Media, 0.0 Vendor Blog, and 0.0 Security Researcher mentions.

Remediation

Patch Available

Vendor Patches (56)

github_advisorypatch availablevia nvd_reference
View patch
mavenpatch availablevia ghsa
Product: io.micronaut:micronaut-json-coreFixed in: 3.8.13
mavenpatch availablevia ghsa
Product: io.micronaut:micronaut-json-coreFixed in: 3.10.5
mavenpatch availablevia ghsa
Product: io.micronaut:micronaut-json-coreFixed in: 4.10.16
redhatvendor investigatingvia redhat_api
Product: Red Hat Fuse 7Fixed in: micronaut-aop
redhatvendor investigatingvia redhat_api
Product: Red Hat Fuse 7Fixed in: micronaut-buffer-netty
redhatvendor investigatingvia redhat_api
Product: Red Hat Fuse 7Fixed in: micronaut-context
redhatvendor investigatingvia redhat_api
Product: Red Hat Fuse 7Fixed in: micronaut-core
redhatvendor investigatingvia redhat_api
Product: Red Hat Fuse 7Fixed in: micronaut-core-reactive
redhatvendor investigatingvia redhat_api
Product: Red Hat Fuse 7Fixed in: micronaut-http
redhatvendor investigatingvia redhat_api
Product: Red Hat Fuse 7Fixed in: micronaut-http-client
redhatvendor investigatingvia redhat_api
Product: Red Hat Fuse 7Fixed in: micronaut-http-client-core
redhatvendor investigatingvia redhat_api
Product: Red Hat Fuse 7Fixed in: micronaut-http-netty
redhatvendor investigatingvia redhat_api
Product: Red Hat Fuse 7Fixed in: micronaut-http-server
redhatvendor investigatingvia redhat_api
Product: Red Hat Fuse 7Fixed in: micronaut-http-server-netty
redhatvendor investigatingvia redhat_api
Product: Red Hat Fuse 7Fixed in: micronaut-inject
redhatvendor investigatingvia redhat_api
Product: Red Hat Fuse 7Fixed in: micronaut-inject-java
redhatvendor investigatingvia redhat_api
Product: Red Hat Fuse 7Fixed in: micronaut-inject-java-test
redhatvendor investigatingvia redhat_api
Product: Red Hat Fuse 7Fixed in: micronaut-router
redhatvendor investigatingvia redhat_api
Product: Red Hat Fuse 7Fixed in: micronaut-runtime
redhatvendor investigatingvia redhat_api
Product: Red Hat Fuse 7Fixed in: micronaut-test-core
redhatvendor investigatingvia redhat_api
Product: Red Hat Fuse 7Fixed in: micronaut-test-junit5
redhatvendor investigatingvia redhat_api
Product: Red Hat Fuse 7Fixed in: micronaut-websocket
redhatvendor investigatingvia redhat_api
Product: Red Hat JBoss Enterprise Application Platform 8Fixed in: micronaut-aop
redhatvendor investigatingvia redhat_api
Product: Red Hat JBoss Enterprise Application Platform 8Fixed in: micronaut-context
redhatvendor investigatingvia redhat_api
Product: Red Hat JBoss Enterprise Application Platform 8Fixed in: micronaut-core
redhatvendor investigatingvia redhat_api
Product: Red Hat JBoss Enterprise Application Platform 8Fixed in: micronaut-core-processor
redhatvendor investigatingvia redhat_api
Product: Red Hat JBoss Enterprise Application Platform 8Fixed in: micronaut-core-reactive
redhatvendor investigatingvia redhat_api
Product: Red Hat JBoss Enterprise Application Platform 8Fixed in: micronaut-discovery-core
redhatvendor investigatingvia redhat_api
Product: Red Hat JBoss Enterprise Application Platform 8Fixed in: micronaut-http
redhatvendor investigatingvia redhat_api
Product: Red Hat JBoss Enterprise Application Platform 8Fixed in: micronaut-http-server
redhatvendor investigatingvia redhat_api
Product: Red Hat JBoss Enterprise Application Platform 8Fixed in: micronaut-inject
redhatvendor investigatingvia redhat_api
Product: Red Hat JBoss Enterprise Application Platform 8Fixed in: micronaut-inject-java
redhatvendor investigatingvia redhat_api
Product: Red Hat JBoss Enterprise Application Platform 8Fixed in: micronaut-retry
redhatvendor investigatingvia redhat_api
Product: Red Hat JBoss Enterprise Application Platform 8Fixed in: micronaut-router
redhatvendor investigatingvia redhat_api
Product: Red Hat JBoss Enterprise Application Platform 8Fixed in: micronaut-validation
redhatvendor investigatingvia redhat_api
Product: Red Hat JBoss Enterprise Application Platform 8Fixed in: resilience4j-micronaut
redhatvendor investigatingvia redhat_api
Product: Red Hat JBoss Enterprise Application Platform 8Fixed in: resilience4j-micronaut-annotation
redhatvendor investigatingvia redhat_api
Product: Red Hat JBoss Enterprise Application Platform Expansion PackFixed in: micronaut-aop
redhatvendor investigatingvia redhat_api
Product: Red Hat JBoss Enterprise Application Platform Expansion PackFixed in: micronaut-context
redhatvendor investigatingvia redhat_api
Product: Red Hat JBoss Enterprise Application Platform Expansion PackFixed in: micronaut-core
redhatvendor investigatingvia redhat_api
Product: Red Hat JBoss Enterprise Application Platform Expansion PackFixed in: micronaut-core-processor
redhatvendor investigatingvia redhat_api
Product: Red Hat JBoss Enterprise Application Platform Expansion PackFixed in: micronaut-core-reactive
redhatvendor investigatingvia redhat_api
Product: Red Hat JBoss Enterprise Application Platform Expansion PackFixed in: micronaut-discovery-core
redhatvendor investigatingvia redhat_api
Product: Red Hat JBoss Enterprise Application Platform Expansion PackFixed in: micronaut-http
redhatvendor investigatingvia redhat_api
Product: Red Hat JBoss Enterprise Application Platform Expansion PackFixed in: micronaut-http-server
redhatvendor investigatingvia redhat_api
Product: Red Hat JBoss Enterprise Application Platform Expansion PackFixed in: micronaut-inject-java
redhatvendor investigatingvia redhat_api
Product: Red Hat JBoss Enterprise Application Platform Expansion PackFixed in: micronaut-retry
redhatvendor investigatingvia redhat_api
Product: Red Hat JBoss Enterprise Application Platform Expansion PackFixed in: micronaut-router
redhatvendor investigatingvia redhat_api
Product: Red Hat JBoss Enterprise Application Platform Expansion PackFixed in: micronaut-validation
redhatvendor investigatingvia redhat_api
Product: Red Hat JBoss Enterprise Application Platform Expansion PackFixed in: resilience4j-micronaut
redhatvendor investigatingvia redhat_api
Product: Red Hat JBoss Enterprise Application Platform Expansion PackFixed in: resilience4j-micronaut-annotation
redhatvendor investigatingvia redhat_api
Product: Red Hat JBoss Enterprise Application Platform Expansion PackFixed in: micronaut-inject
redhatvendor investigatingvia redhat_api
Product: Red Hat build of Apache Camel for Spring Boot 4Fixed in: jkube-kit-micronaut
redhatvendor investigatingvia redhat_api
Product: Red Hat Fuse 7Fixed in: bolt-micronaut
redhatvendor investigatingvia redhat_api
Product: Red Hat Fuse 7Fixed in: jkube-kit-micronaut

Vendor Advisories (2)

redhatCVE-2026-33013Moderate

micronaut-core: Micronaut Framework: Micronaut Framework: Denial of Service via crafted form parameters

Mar 20, 2026
mavenGHSA-43w5-mmxv-cpvhhigh

Micronaut vulnerable to DoS via crafted form-urlencoded body binding with descending array indices

Mar 17, 2026

References

github.com / micronaut-projects/micronaut-core/commit/1afe509677c51b320041b7a2c177366d4a4deb55
Patch
github.com / micronaut-projects/micronaut-core/pull/12410
Issue Tracking
github.com / micronaut-projects/micronaut-core/releases/tag/v3.10.5
Release Notes
github.com / micronaut-projects/micronaut-core/releases/tag/v4.10.16
Release Notes
github.com / micronaut-projects/micronaut-core/security/advisories/GHSA-43w5-mmxv-cpvh
ExploitPatchVendor Advisory