What is the CVSS score of CVE-2026-33013?

CVE-2026-33013 has a CVSS 3.1 base score of 7.5 (High). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H. EPSS exploitation probability: 0.2%.

Which versions of Java are affected by CVE-2026-33013?

Organizations using Micronaut Framework face notable risk from CVE-2026-33013 rated CVSS 7.5. Exploitation could compromise the security of affected deployments.. A patch is available.

How to fix or mitigate CVE-2026-33013?

Within 7 days: Identify all affected systems and apply vendor patches promptly. Monitor vendor channels for patch availability.

Java CVE-2026-33013

HIGH

Loop with Unreachable Exit Condition (Infinite Loop) (CWE-835)

2026-03-20 security-advisories@github.com

GHSA-43w5-mmxv-cpvh

Java Denial Of Service Red Hat

7.5

CVSS 3.1 · GitHub Advisory

Severity by source

GitHub Advisory PRIMARY

7.5 HIGH

AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

Red Hat

6.5 MEDIUM

qualitative

Primary rating from GitHub Advisory.

CVSS VectorGitHub Advisory

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Unchanged

Confidentiality

None

Integrity

None

Availability

High

Lifecycle Timeline

Patch released

Mar 31, 2026 - 21:13 nvd

Patch available

Analysis Generated

Mar 20, 2026 - 08:37 vuln.today

CVE Published

Mar 20, 2026 - 05:16 nvd

HIGH 7.5

Blast Radius

ecosystem impact

† from your stack dependencies † transitive graph · vuln.today resolves 4-path depth

121 maven packages depend on io.micronaut:micronaut-json-core (9 direct, 112 indirect)

Ecosystem-wide dependent count for version 4.0.0-M1.

DescriptionGitHub Advisory

Micronaut Framework is a JVM-based full stack Java framework designed for building modular, easily testable JVM applications. Versions prior to both 4.10.16 and 3.10.5 do not correctly handle descending array index order during form-urlencoded body binding in theJsonBeanPropertyBinder::expandArrayToThreshold, which allows remote attackers to cause a DoS (non-terminating loop, CPU exhaustion, and OutOfMemoryError) via crafted indexed form parameters (e.g., authors[1].name followed by authors[0].name). This issue has been fixed in versions 4.10.16 and 3.10.5.

AnalysisAI

The Micronaut Framework contains an infinite loop vulnerability in its form-urlencoded body binding mechanism that occurs when array indices are processed in descending order, allowing remote attackers to trigger denial of service through CPU exhaustion and out-of-memory conditions. Versions prior to 4.10.16 and 3.10.5 are affected, with the vulnerability exploitable by sending crafted indexed form parameters without authentication. No public exploit code has been confirmed, but the issue is straightforward to trigger and has been patched in the referenced versions.

Technical ContextAI

The vulnerability exists in the JsonBeanPropertyBinder::expandArrayToThreshold method within the Micronaut Framework, a JVM-based microservices framework for building Java applications. The root cause is classified as CWE-835 (Loop with Unreachable Exit Condition), where the array expansion logic fails to correctly handle descending index ordering in form-urlencoded POST body parameters. When parameters like 'authors[1].name' are received before 'authors[0].name', the binding mechanism enters an infinite loop attempting to expand the array to accommodate indices, consuming CPU cycles and memory until resource exhaustion occurs. This impacts all Micronaut-based applications that accept form-urlencoded input and perform automatic bean property binding without input validation.

RemediationAI

Upgrade Micronaut Framework to version 4.10.16 or later for 4.x deployments, or to version 3.10.5 or later for 3.x deployments. Update the dependency in your build configuration (Maven pom.xml or Gradle build.gradle) and redeploy affected services. For immediate mitigation before patching is possible, implement input validation on form-urlencoded parameters to reject requests with unexpected array indices or limit the maximum array size processed by the binder. Additionally, deploy a Web Application Firewall or reverse proxy configured to detect and block suspicious indexed form parameters (e.g., parameters with indices exceeding a reasonable threshold). Network segmentation restricting access to the affected application endpoints can reduce attack surface. Refer to the official patch releases at https://github.com/micronaut-projects/micronaut-core/releases/tag/v3.10.5 and https://github.com/micronaut-projects/micronaut-core/releases/tag/v4.10.16 for deployment guidance.