GitHub Advisoryadvisory · Maven

GHSA-3pjv-r7w4-2cf5 Grails data binding causes JVM crash and/or other denial of service

MEDIUM Published 2023-12-20 Modified 2023-12-21 Official page ↗
Aliases
CVE-2023-46131
Ecosystem
Maven
Packages
org.grails:grails-databinding
Severity
Moderate
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H
Weaknesses
CWE-400
Reviewed
2023-12-20

Affected packages

• Maven org.grails:grails-databinding: >= 6.0.0, < 6.1.0 → fixed in 6.1.0 • Maven org.grails:grails-databinding: >= 5.0.0, < 5.3.4 → fixed in 5.3.4 • Maven org.grails:grails-databinding: >= 4.0.0, < 4.1.3 → fixed in 4.1.3 • Maven org.grails:grails-databinding: >= 2.0.0, < 3.3.17 → fixed in 3.3.17

Description

Impact A specially crafted web request can lead to a JVM crash or denial of service. Any Grails framework application using Grails data binding is vulnerable. Patches Patches are available for Grails 3 and later. Workarounds No workaround is possible except to avoid data binding to request data. References • Blog post • Discussion • Mitre CVD record

Related

Alias · CVE (1)

  • CVE-2023-46131 Grails is a framework used to build web applications with the Groovy programming language. vulnerability

Weakness · CWE (1)

  • CWE-400 Uncontrolled Resource Consumption weakness

References