DoS Flaws in Micronaut and Netty Let Remote Attackers Exhaust Server Resources
Vulnerability Disclosure · 2 sources · Updated 4mo ago · First seen Mar 20, 2026
Two high-severity denial-of-service vulnerabilities were disclosed in widely used Java infrastructure components, allowing remote attackers to exhaust CPU and memory and disrupt application availability without authentication. In Micronaut, CVE-2026-33013 affects versions before 4.10.16 and 3.10.5 and is caused by improper handling of descending array indices during application/x-www-form-urlencoded body binding in JsonBeanPropertyBinder::expandArrayToThreshold. A crafted request using indexed parameters such as authors[1].name followed by authors[0].name can trigger a non-terminating loop, CPU exhaustion, and an OutOfMemoryError.
Netty separately patched CVE-2026-33871, a denial-of-service flaw in HTTP/2 processing that affects versions before 4.1.132.Final and 4.2.10.Final. The bug lets attackers flood servers with CONTINUATION frames because the framework did not enforce a limit on their number, and existing size-based protections could be bypassed with zero-byte frames. The result is excessive CPU consumption with minimal bandwidth, potentially leaving HTTP/2 services unresponsive. The issues are tracked as CWE-835 in Micronaut and CWE-770 in Netty, and both vendors released fixed versions for affected branches.
