Loading story…
Two high-severity denial-of-service vulnerabilities were disclosed in widely used Java infrastructure components, allowing remote attackers to exhaust CPU and memory and disrupt application availability without authentication. In Micronaut, CVE-2026-33013 affects versions before 4.10.16 and 3.10.5 and is caused by improper handling of descending array indices during application/x-www-form-urlencoded body binding in JsonBeanPropertyBinder::expandArrayToThreshold. A crafted request using indexed parameters such as authors[1].name followed by authors[0].name can trigger a non-terminating loop, CPU exhaustion, and an OutOfMemoryError.
Netty separately patched CVE-2026-33871, a denial-of-service flaw in HTTP/2 processing that affects versions before 4.1.132.Final and 4.2.10.Final. The bug lets attackers flood servers with CONTINUATION frames because the framework did not enforce a limit on their number, and existing size-based protections could be bypassed with zero-byte frames. The result is excessive CPU consumption with minimal bandwidth, potentially leaving HTTP/2 services unresponsive. The issues are tracked as CWE-835 in Micronaut and CWE-770 in Netty, and both vendors released fixed versions for affected branches.
Mallory correlates global threat intelligence with your attack surface — know if you’re exposed before adversaries strike.
4 events from the most recent confirmed update back to the earliest known activity.
Netty fixed the HTTP/2 CONTINUATION frame flood vulnerability in versions 4.1.132.Final and 4.2.10.Final. The update closed the zero-byte frame bypass and addressed the lack of limits that enabled remote DoS.
A new CVE was published for Netty describing a denial-of-service issue in HTTP/2 servers caused by unlimited CONTINUATION frames and a zero-byte frame bypass of size-based mitigations. The flaw affected versions prior to 4.1.132.Final and 4.2.10.Final and could drive high CPU usage with minimal bandwidth.
Micronaut addressed CVE-2026-33013 in versions 4.10.16 and 3.10.5. The fix remediated incorrect handling in JsonBeanPropertyBinder::expandArrayToThreshold that allowed remote DoS via crafted indexed form parameters.
A denial-of-service flaw in Micronaut's form-urlencoded body binding was received by security-advisories@github.com. The bug involved descending array indices causing a non-terminating loop, CPU exhaustion, and possible OutOfMemoryError.
Vulnerabilities, threat actors, malware, products, organizations, and breaches Mallory has linked to this story.
2 references tracked. Mallory keeps watching after this page renders.
cvefeed.io
Open sourcecvefeed.io
Open sourceMap indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
Netty published a broad set of security advisories covering **22 vulnerabilities** across its networking stack, with impacts ranging from remote denial of service to trust-boundary failures. The issues affect multiple modules and protocols, including **HTTP/2, HTTP/3, QUIC, DNS, Redis, SCTP, Unix domain sockets, HAProxy PROXY protocol v2, and TLS handling**. Reported consequences include uncontrolled memory allocation, `ByteBuf` and file descriptor leaks, failure to enforce HTTP/2 stream limits, DNS cache poisoning, improper TLS hostname validation, IPv6 subnet access-control bypass, request smuggling, and QUIC reflection or stateless reset abuse. One of the most serious flaws, **`CVE-2026-45416`**, allows a remote attacker to send as little as **nine bytes** in a crafted TLS `ClientHello` and trigger roughly **16 MiB** of unpooled direct-memory allocation per connection in Netty's SNI handling path. Because the buffer can remain allocated until the connection closes, repeated connections can exhaust direct memory and disrupt services. The flaw affects **Netty 4.1.x before `4.1.135.Final`** and **4.2.0.Final through `4.2.14.Final`**, and was fixed in **`4.1.135.Final`** and **`4.2.15.Final`**; the wider advisory set was published through Netty's GitHub security advisories and highlights the risk to Java applications that embed Netty as a dependency.
Jul 10, 2026
Spring disclosed two high-severity denial-of-service vulnerabilities in Micrometer server instrumentation: **CVE-2026-40984** affecting HTTP server instrumentations and **CVE-2026-40983** affecting gRPC server instrumentation. The HTTP issue can be triggered by specially crafted HTTP requests in applications using vulnerable versions of `micrometer-core`, `micrometer-jetty11`, or `micrometer-jetty12` with HTTP server instrumentation and metrics recording enabled. The gRPC issue can be triggered by specially crafted gRPC requests when applications use vulnerable `io.micrometer:micrometer-core` releases together with `ObservationRegistry`, metric-producing observation handlers, and `ObservationGrpcServerInterceptor`. Affected versions include Micrometer `1.16.0` through `1.16.5` and `1.15.0` through `1.15.11`, with the HTTP flaw also spanning additional older supported and unsupported release lines. Spring released fixes for open-source users in **Micrometer `1.16.6` and `1.15.12`**, while enterprise-supported fixes for the HTTP issue are available in `1.14.16`, `1.13.19`, and `1.9.18`. The vulnerabilities were responsibly reported by Yu Bao of PayPal, and the Canadian Centre for Cyber Security urged administrators to review Spring’s advisories and apply the necessary updates.
Jun 29, 2026
A newly disclosed denial-of-service flaw in multiple HTTP/2 server implementations allows remote, unauthenticated attackers to exhaust memory and crash services by abusing normal flow-control behavior. By stalling outbound data transmission—such as by manipulating `SETTINGS_INITIAL_WINDOW_SIZE` or withholding `WINDOW_UPDATE` frames—an attacker can cause vulnerable servers to keep generating and buffering full responses, leading to out-of-memory conditions, swap thrashing, worker-thread exhaustion, service freezes, or kernel OOM kills. CERT/CC is tracking the issue after it was reported by the Okta Red Team, and the coordinated disclosures include `CVE-2026-44909`, `CVE-2026-59173`, and `CVE-2026-59762`. Affected vendors named in advisories include Apache Traffic Server, Citrix, F5 Networks, Meta, Red Hat, SUSE, and Yahoo. Apache Traffic Server users were advised to upgrade to versions `9.1.14` or `10.1.3`, while F5 published guidance for BIG-IP and other vendors issued product-specific fixes or mitigations. Recommended defenses include stricter memory limits, limiting concurrent HTTP/2 streams, terminating stalled connections, and improving timeout and backpressure handling. No public exploitation has been confirmed, but the low complexity of the attack has prompted calls for rapid patching and configuration hardening.
Jul 24, 2026