CVE-2023-46131: Grails® data binding causes JVM crash and/or DoS
Impact A specially crafted web request can lead to a JVM crash or denial of service. Any Grails framework application using Grails data binding is vulnerable.
Patches Patches are available for Grails 3 and later.
Workarounds No workaround is possible except to avoid data binding to request data.
References
- Blog post - Discussion - Mitre CVD record
Other sources
Grails is a framework used to build web applications with the Groovy programming language. A specially crafted web request can lead to a JVM crash or denial of service. Any Grails framework application using Grails data binding is vulnerable. This issue has been patched in version 3.3.17, 4.1.3, 5.3.4, 6.1.0.
Affected Software
Remediation
Event History
Frequently Asked Questions
What is the severity of CVE-2023-46131?
CVE-2023-46131 has a severity that can lead to a JVM crash or denial of service.
How do I fix CVE-2023-46131?
To fix CVE-2023-46131, upgrade the Grails data binding library to versions 3.3.17, 4.1.3, 5.3.4, or 6.1.0.
Which versions of Grails are affected by CVE-2023-46131?
CVE-2023-46131 affects Grails versions prior to 3.3.17, between 4.0.0 and 4.1.3, between 5.0.0 and 5.3.4, and between 6.0.0 and 6.1.0.
Is there a workaround for CVE-2023-46131?
No workaround is available for CVE-2023-46131, except to avoid using Grails data binding.
What impact does CVE-2023-46131 have on Grails applications?
CVE-2023-46131 can cause crashes or denial of service for any Grails framework application using Grails data binding.