CVE-2026-33013: 
Java vulnerability analysis and mitigation

CVE-2026-33013 is a Denial of Service vulnerability in Micronaut Framework, a JVM-based full stack Java framework, caused by improper handling of descending array index order during form-urlencoded body binding. The flaw exists in JsonBeanPropertyBinder::expandArrayToThreshold within the io.micronaut:micronaut-json-core package. Affected versions include all Micronaut 3.x releases before 3.10.5 (and 3.8.x before 3.8.13) and all Micronaut 4.x releases before 4.10.16. The vulnerability was published on March 20, 2026, with patches merged on February 25–26, 2026. It carries a CVSS v3.1 base score of 7.5 (High) and a CVSS v4.0 base score of 8.2 (High) (GitHub Advisory, Red Hat Bugzilla).

The root cause is an infinite loop condition (CWE-835) combined with improper validation of array index input (CWE-1285) in the expandArrayToThreshold method of JsonBeanPropertyBinder. The original code used a != comparison (while (arrayNode.values.size() != arrayIndex + 1)) to expand an array to a target index; when form parameters are submitted in descending index order (e.g., authors[1].name before authors[0].name), the array size overshoots the target index, causing the condition to never be satisfied and resulting in a non-terminating loop. The fix, applied in commit 1afe509, changes the comparison to < (while (arrayNode.values.size() < arrayIndex + 1)), which correctly handles both ascending and descending index orders. No authentication or special privileges are required to trigger the vulnerability — any HTTP endpoint accepting application/x-www-form-urlencoded body binding with array-typed fields is susceptible (GitHub Commit, GitHub Advisory).

Successful exploitation causes the Micronaut application to enter a non-terminating loop, leading to sustained CPU exhaustion and unbounded memory growth that ultimately results in an OutOfMemoryError and application crash. The impact is limited to availability — there is no confidentiality or integrity impact, and no data exposure or lateral movement risk is associated with this vulnerability. Any Micronaut service exposing endpoints that accept form-urlencoded bodies with array-typed parameters is at risk of complete service disruption from a single unauthenticated request (GitHub Advisory, Red Hat Bugzilla).

1. Reconnaissance: Identify internet-facing services built on Micronaut Framework (versions < 4.10.16 or < 3.10.5) that expose HTTP endpoints accepting application/x-www-form-urlencoded content with array-typed body parameters (e.g., a Book object with a List<Author> authors field).
2. Craft malicious request: Construct a form-urlencoded POST request with array parameters submitted in descending index order — specifically, a higher index before a lower index (e.g., authors[1].name=RobertGalbraith followed by authors[0].name=JKRowling).
3. Send the request: Deliver the crafted request to the vulnerable endpoint using a tool such as curl:

   curl -v -X POST 'http://<target>/submit' \
     -H 'Content-Type: application/x-www-form-urlencoded' \
     --data-urlencode 'authors[1].name=RobertGalbraith' \
     --data-urlencode 'authors[0].name=JKRowling'

4. Trigger DoS: The expandArrayToThreshold method enters a non-terminating loop, causing sustained CPU exhaustion and unbounded memory growth, eventually crashing the JVM with an OutOfMemoryError and rendering the service unavailable (GitHub Advisory).

• Network: Repeated HTTP POST requests to form-accepting endpoints with Content-Type: application/x-www-form-urlencoded containing array parameters in descending index order (e.g., authors%5B1%5D.name=...&authors%5B0%5D.name=...).
• Logs: Application server access logs showing POST requests to form-binding endpoints immediately followed by service unresponsiveness or JVM crash events; Java heap space or OutOfMemoryError entries in application logs.
• Process: Sudden spike in CPU utilization by the Micronaut JVM process to near 100% with no corresponding increase in legitimate traffic; JVM process termination or restart events.
• File System: JVM crash dump files (e.g., hs_err_pid*.log) generated in the application working directory indicating heap exhaustion.

The Micronaut project has released patches addressing this vulnerability: upgrade to Micronaut 4.10.16 (for 4.x users), Micronaut 3.10.5 (for 3.10.x users), or Micronaut 3.8.13 (for 3.8.x users). The fix changes the loop condition in expandArrayToThreshold from != to <, preventing the infinite loop when array indices are submitted in descending order. The official advisory states there is no workaround available without upgrading; however, as a temporary measure, operators may consider implementing a WAF rule or input validation layer to reject or normalize form-urlencoded requests containing non-sequential or descending array indices before they reach the application (GitHub Advisory, GitHub Release).

The vulnerability was credited to researcher shblue21 as the finder, and the fix was authored and merged by Micronaut core contributor sdelamo on February 25, 2026, prior to public disclosure on March 20, 2026 (GitHub Advisory). Red Hat tracked the issue via Bugzilla with a medium severity rating and assigned it to their Product Security DevOps Team (Red Hat Bugzilla). No significant broader media coverage or notable social media commentary beyond standard CVE tracking feeds has been identified.