CVE-2026-33013: Micronaut Framework DoS Vulnerability

CVE-2026-33013 Overview

CVE-2026-33013 is a Denial of Service (DoS) vulnerability affecting Micronaut Framework, a JVM-based full stack Java framework designed for building modular, easily testable applications. The vulnerability exists in the JsonBeanPropertyBinder::expandArrayToThreshold method, which fails to correctly handle descending array index order during form-urlencoded body binding. This flaw allows remote attackers to cause service disruption through CPU exhaustion and memory depletion.

Critical Impact

Remote attackers can exploit this vulnerability to cause a non-terminating loop, leading to CPU exhaustion and OutOfMemoryError, effectively rendering affected Micronaut applications unavailable.

Affected Products

• Micronaut Framework versions prior to 4.10.16
• Micronaut Framework versions prior to 3.10.5
• Applications using form-urlencoded body binding with indexed parameters

Discovery Timeline

• 2026-03-20 - CVE CVE-2026-33013 published to NVD
• 2026-03-24 - Last updated in NVD database

Technical Details for CVE-2026-33013

Vulnerability Analysis

This vulnerability is classified as CWE-835 (Loop with Unreachable Exit Condition), commonly known as an infinite loop vulnerability. The flaw resides in the JsonBeanPropertyBinder::expandArrayToThreshold method within the Micronaut Framework's form-urlencoded body binding logic.

When processing indexed form parameters, the framework expects array indices to be provided in ascending order. However, when an attacker submits parameters with descending indices (e.g., authors[1].name followed by authors[0].name), the array expansion logic enters a non-terminating loop. This occurs because the threshold calculation and iteration logic assumes sequential index processing and fails to properly handle reverse-ordered indices.

The network-accessible attack vector combined with no authentication requirements makes this vulnerability particularly concerning for publicly exposed Micronaut applications.

Root Cause

The root cause lies in improper input validation within the expandArrayToThreshold method. The code fails to account for scenarios where array indices arrive in descending order during form data binding. When the expansion logic attempts to process these out-of-order indices, it enters an infinite loop condition, continuously consuming CPU cycles and allocating memory until the JVM exhausts available resources or throws an OutOfMemoryError.

Attack Vector

The attack is executed remotely over the network by sending specially crafted HTTP POST requests with form-urlencoded content containing indexed parameters in descending order. No authentication or user interaction is required, making exploitation straightforward for any attacker who can reach the application endpoint.

An attacker would craft a malicious HTTP request containing form parameters such as authors[1].name=value1&authors[0].name=value2, where the higher index appears before the lower index in the request body. When the Micronaut application parses this request, the vulnerable code path is triggered, causing the application to enter an infinite loop and eventually crash due to resource exhaustion.

Detection Methods for CVE-2026-33013

Indicators of Compromise

• Unexpected CPU spikes to 100% utilization on servers running Micronaut applications
• OutOfMemoryError exceptions in application logs, particularly in conjunction with form data processing
• HTTP requests containing indexed form parameters with non-sequential or descending array indices
• Application thread pools becoming exhausted or unresponsive

Detection Strategies

• Monitor JVM heap usage and garbage collection patterns for abnormal growth during request processing
• Implement request logging to capture form-urlencoded POST requests with indexed array parameters
• Deploy application performance monitoring (APM) tools to detect infinite loop conditions and thread hangs
• Configure alerts for sudden increases in response latency or request timeouts on form submission endpoints

Monitoring Recommendations

• Enable detailed logging for the io.micronaut.core.bind package to capture binding operations
• Set up threshold-based alerts for CPU utilization exceeding normal operational parameters
• Monitor JVM memory metrics including heap usage, GC frequency, and allocation rates
• Implement circuit breakers or request timeout policies to limit impact of potential exploitation attempts

How to Mitigate CVE-2026-33013

Immediate Actions Required

• Upgrade Micronaut Framework to version 4.10.16 or later for the 4.x branch
• Upgrade Micronaut Framework to version 3.10.5 or later for the 3.x branch
• Implement request filtering at the web application firewall (WAF) level to detect and block suspicious indexed form parameters
• Review application endpoints that accept form-urlencoded data and consider adding input validation

Patch Information

Object Computing has released security patches addressing this vulnerability. The fix is available in Micronaut Framework versions 4.10.16 and 3.10.5. The patch corrects the array expansion logic in JsonBeanPropertyBinder::expandArrayToThreshold to properly handle descending array indices without entering an infinite loop.

For detailed technical information about the fix, refer to the GitHub Security Advisory GHSA-43w5-mmxv-cpvh and the associated pull request. The specific commit implementing the fix is available at commit 1afe509.

Workarounds

• Deploy a reverse proxy or WAF rule to normalize or reject requests containing descending indexed form parameters
• Implement custom input validation middleware to pre-validate array indices before they reach Micronaut's binding logic
• Consider temporarily disabling endpoints that accept indexed form parameters if they are not critical to application functionality
• Apply request rate limiting to form submission endpoints to reduce the impact of potential exploitation attempts

# Example: Update Micronaut dependency in build.gradle
# For Micronaut 4.x:
micronautVersion=4.10.16

# For Micronaut 3.x:
micronautVersion=3.10.5