{"id":"CVE-2023-46131","summary":"Grails® data binding causes JVM crash and/or DoS ","details":"Grails is a framework used to build web applications with the Groovy programming language. A specially crafted web request can lead to a JVM crash or denial of service. Any Grails framework application using Grails data binding is vulnerable. This issue has been patched in version 3.3.17, 4.1.3, 5.3.4, 6.1.0.\n","aliases":["GHSA-3pjv-r7w4-2cf5"],"modified":"2026-08-27T10:10:44.769436Z","published":"2023-12-20T23:24:27.227Z","database_specific":{"cna_assigner":"GitHub_M","cwe_ids":["CWE-400"],"osv_generated_from":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2023/46xxx/CVE-2023-46131.json"},"references":[{"type":"ADVISORY","url":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2023/46xxx/CVE-2023-46131.json"},{"type":"ADVISORY","url":"https://github.com/grails/grails-core/security/advisories/GHSA-3pjv-r7w4-2cf5"},{"type":"ADVISORY","url":"https://nvd.nist.gov/vuln/detail/CVE-2023-46131"},{"type":"REPORT","url":"https://github.com/grails/grails-core/issues/13302"},{"type":"FIX","url":"https://github.com/grails/grails-core/commit/74326bdd2cf7dcb594092165e9464520f8366c60"},{"type":"FIX","url":"https://github.com/grails/grails-core/commit/c401faaa6c24c021c758b95f72304a0e855a8db3"},{"type":"ARTICLE","url":"https://grails.org/blog/2023-12-20-cve-data-binding-dos.html"}],"affected":[{"ranges":[{"type":"GIT","repo":"https://github.com/apache/grails-core","events":[{"introduced":"ea30f160d8b7f207bc0c0e9919453eb41148bf70"},{"fixed":"380df5277808d736896dce38363bd19aa9729d83"},{"introduced":"10252ac29a53968cb14380078386089185cb514c"},{"fixed":"c1f137cdfd4b136fb1fcff720b58ab6cd3a5c94b"},{"introduced":"b6337fc5ec6c38c04aad8f802a7b345325a24711"},{"fixed":"46bd1e84369304f34d98108356bf7f390527a9c4"},{"introduced":"29dae86afc77c80caf5bfba20a494a61531274cc"},{"fixed":"a1e5c062c20ebc6004bc03e39bbd3d400406c5c2"}],"database_specific":{"extracted_events":[{"introduced":"6.0.0"},{"fixed":"6.1.0"},{"introduced":"5.0.0"},{"fixed":"5.3.4"},{"introduced":"4.0.0"},{"fixed":"4.1.3"},{"introduced":"2.0.0"},{"fixed":"3.3.17"}],"source":"AFFECTED_FIELD"}}],"versions":["v6.0.0","v5.3.3","v5.3.2","v5.3.1","v5.3.0","v5.2.5","v5.2.4","v5.2.3","v4.1.2","v5.2.2","v4.1.1","v5.2.1","v5.2.0","v4.1.0","v5.1.2","v5.1.1","archive/master","v4.0.13","v5.0.1","v5.0.0","v4.0.12","v4.0.11","v4.0.10","v4.0.9","v4.0.8","v4.0.7","v4.0.6","v4.0.5","v4.0.4","v4.0.3","v4.0.2","v4.0.1","v4.0.0"],"database_specific":{"vanir_signatures":[{"deprecated":false,"digest":{"line_hashes":["180278373709165118417166122179622297968","26059604116491701966158775258683094083","39516088956461942001629526441418841973","56771208745788233037596262371718699855"],"threshold":0.9},"id":"CVE-2023-46131-1a2d52f5","signature_type":"Line","signature_version":"v1","source":"https://github.com/apache/grails-core/commit/46bd1e84369304f34d98108356bf7f390527a9c4","target":{"file":"grails-core/src/test/groovy/grails/util/GrailsUtilTests.java"}},{"source":"https://github.com/apache/grails-core/commit/46bd1e84369304f34d98108356bf7f390527a9c4","target":{"file":"grails-core/src/test/groovy/grails/util/GrailsUtilTests.java","function":"testGrailsVersion"},"deprecated":false,"digest":{"function_hash":"108601858541748486099231159226667596254","length":82},"id":"CVE-2023-46131-21a42727","signature_type":"Function","signature_version":"v1"},{"signature_version":"v1","source":"https://github.com/apache/grails-core/commit/c1f137cdfd4b136fb1fcff720b58ab6cd3a5c94b","target":{"file":"grails-core/src/test/groovy/grails/util/GrailsUtilTests.java"},"deprecated":false,"digest":{"threshold":0.9,"line_hashes":["337496942895711058712666699513223965884","107103859451640210312626046319643736042","304875401731763760510325088291425210408","213175982824135846302367363610967692969"]},"id":"CVE-2023-46131-94ea7462","signature_type":"Line"},{"signature_type":"Line","signature_version":"v1","source":"https://github.com/apache/grails-core/commit/380df5277808d736896dce38363bd19aa9729d83","target":{"file":"grails-core/src/test/groovy/grails/util/GrailsUtilTests.java"},"deprecated":false,"digest":{"line_hashes":["58988914909210438975374164824513154132","112889167782485667212421752624805111888","236408529206960066417413273184127917569","45618127076438977776807525920629884833"],"threshold":0.9},"id":"CVE-2023-46131-bd49d99c"},{"target":{"file":"grails-core/src/test/groovy/grails/util/GrailsUtilTests.java","function":"testGrailsVersion"},"deprecated":false,"digest":{"function_hash":"184841908302478389270118139807086425292","length":82},"id":"CVE-2023-46131-c40967d4","signature_type":"Function","signature_version":"v1","source":"https://github.com/apache/grails-core/commit/380df5277808d736896dce38363bd19aa9729d83"},{"source":"https://github.com/apache/grails-core/commit/c1f137cdfd4b136fb1fcff720b58ab6cd3a5c94b","target":{"file":"grails-core/src/test/groovy/grails/util/GrailsUtilTests.java","function":"testGrailsVersion"},"deprecated":false,"digest":{"function_hash":"66563932974826409094969729312577659","length":82},"id":"CVE-2023-46131-d9c7453e","signature_type":"Function","signature_version":"v1"},{"signature_version":"v1","source":"https://github.com/apache/grails-core/commit/a1e5c062c20ebc6004bc03e39bbd3d400406c5c2","target":{"file":"grails-core/src/test/groovy/grails/util/GrailsUtilTests.java"},"deprecated":false,"digest":{"line_hashes":["130431675608071333095843898851711893356","21494170457314484516170706289539913189","73441350588505585438140269813517716538","43316565359570715933884811531944808587"],"threshold":0.9},"id":"CVE-2023-46131-da74d945","signature_type":"Line"},{"deprecated":false,"digest":{"function_hash":"285370394617566884857863694342641515638","length":89},"id":"CVE-2023-46131-dab18d76","signature_type":"Function","signature_version":"v1","source":"https://github.com/apache/grails-core/commit/a1e5c062c20ebc6004bc03e39bbd3d400406c5c2","target":{"file":"grails-core/src/test/groovy/grails/util/GrailsUtilTests.java","function":"testGrailsVersion"}}],"source":"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2023-46131.json","vanir_signatures_modified":"2026-08-27T10:10:44Z"}}],"schema_version":"1.9.0","severity":[{"type":"CVSS_V3","score":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H"}]}