CVE-2026-33013

Katalog CVE

CVSS 7.5 · High EPSS 0,78%

Kerentanan Loop with Unreachable Exit Condition ('Infinite Loop') pada objectcomputing micronaut. Skor CVSS 3.1 7.5 (High) menurut NVD.

Deskripsi (NVD)

Micronaut Framework is a JVM-based full stack Java framework designed for building modular, easily testable JVM applications. Versions prior to both 4.10.16 and 3.10.5 do not correctly handle descending array index order during form-urlencoded body binding in theJsonBeanPropertyBinder::expandArrayToThreshold, which allows remote attackers to cause a DoS (non-terminating loop, CPU exhaustion, and OutOfMemoryError) via crafted indexed form parameters (e.g., authors[1].name followed by authors[0].name). This issue has been fixed in versions 4.10.16 and 3.10.5.

Rincian

Terbit di NVD

20 Maret 2026

Terakhir diubah

17 Juni 2026

Status NVD

Analyzed

CVSS 3.1

7.5 (High), sumber NVD
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H · uraikan di kalkulator

Jenis kelemahan (CWE)

CWE-835: Loop with Unreachable Exit Condition ('Infinite Loop')

EPSS (30 hari)

0,78% peluang dieksploitasi; lebih tinggi dari 54,6% CVE lain

Produk dan versi terdampak

> Data dari konfigurasi CPE di NVD.

Referensi dan perbaikan

• https://github.com/micronaut-projects/micronaut-core/security/advisories/GHSA-43w5-mmxv-cpvh exploit · patch · advisory vendor
• https://github.com/micronaut-projects/micronaut-core/commit/1afe509677c51b320041b7a2c177366d4a4deb55 patch
• https://github.com/micronaut-projects/micronaut-core/pull/12410 issue tracking
• https://github.com/micronaut-projects/micronaut-core/releases/tag/v3.10.5 release notes
• https://github.com/micronaut-projects/micronaut-core/releases/tag/v4.10.16 release notes