CVE-2023-46131
Grails® data binding causes JVM crash and/or DoS
Grails is a framework used to build web applications with the Groovy programming language. A specially crafted web request can lead to a JVM crash or denial of service. Any Grails framework application using Grails data binding is vulnerable. This issue has been patched in version 3.3.17, 4.1.3, 5.3.4, 6.1.0.
Attack profile
How easy it is to exploit
- Attack vector
- Network
- Complexity
- Low
- Privileges needed
- Low
- User interaction
- None
What an attacker can affect
- Confidentiality
- None
- Integrity
- None
- Availability
- High
Exploit likelihood
What each source reports
CVE List Score used
Grails® data binding causes JVM crash and/or DoS
Grails is a framework used to build web applications with the Groovy programming language. A specially crafted web request can lead to a JVM crash or denial of service. Any Grails framework application using Grails data binding is vulnerable. This issue has been patched in version 3.3.17, 4.1.3, 5.3.4, 6.1.0.
- Record
CVE-2023-46131- CVSS 3.1
- 6.5 Medium
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H - Weakness
- CWE-400
- Updated
- 2026-11-02
EUVDEUVD-2023-3085
Grails is a framework used to build web applications with the Groovy programming language. A specially crafted web request can lead to a JVM crash or denial of service. Any Grails framework application using Grails data binding is vulnerable. This issue has been patched in version 3.3.17, 4.1.3, 5.3.4, 6.1.0.
- Record
EUVD-2023-3085- CVSS 3.1
- 6.5 Medium
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H - Updated
- 2026-11-03
GitHub AdvisoriesGHSA-3pjv-r7w4-2cf5
Grails data binding causes JVM crash and/or other denial of service
Impact
A specially crafted web request can lead to a JVM crash or denial of service. Any Grails framework application using Grails data binding is vulnerable.
Patches
Patches are available for Grails 3 and later.
Workarounds
No workaround is possible except to avoid data binding to request data.
References
- Record
GHSA-3pjv-r7w4-2cf5- CVSS 3.1
- 6.5 Medium
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H - Weakness
- CWE-400
- Updated
- 2026-11-02
NVD
Grails is a framework used to build web applications with the Groovy programming language. A specially crafted web request can lead to a JVM crash or denial of service. Any Grails framework application using Grails data binding is vulnerable. This issue has been patched in version 3.3.17, 4.1.3, 5.3.4, 6.1.0.
- Record
CVE-2023-46131- CVSS 3.1
- 6.5 Medium
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H - CVSS 3.1
- 7.5 High
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H - Weakness
- CWE-400
- Updated
- 2026-11-02
OSV
Grails® data binding causes JVM crash and/or DoS
Grails is a framework used to build web applications with the Groovy programming language. A specially crafted web request can lead to a JVM crash or denial of service. Any Grails framework application using Grails data binding is vulnerable. This issue has been patched in version 3.3.17, 4.1.3, 5.3.4, 6.1.0.
- Record
CVE-2023-46131- CVSS 3.1
- 6.5 Medium
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H - Weakness
- CWE-400
- Updated
- 2026-11-02
OSVGHSA-3pjv-r7w4-2cf5
Grails data binding causes JVM crash and/or other denial of service
Impact
A specially crafted web request can lead to a JVM crash or denial of service. Any Grails framework application using Grails data binding is vulnerable.
Patches
Patches are available for Grails 3 and later.
Workarounds
No workaround is possible except to avoid data binding to request data.
References
- Record
GHSA-3pjv-r7w4-2cf5- CVSS 3.1
- 6.5 Medium
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H - Weakness
- CWE-400
- Updated
- 2026-11-02
OSVCLSA-2026-1784077496 No score
TuxCare security update for org.grails:grails-databinding (1 CVE)
TuxCare rebuilt org.grails:grails-databinding to address 1 CVE. Fixed in 2.5.6-tuxcare.1.
- Record
CLSA-2026-1784077496- Updated
- 2026-11-02
Affected products
Affected packages
| Package | Affected | Fixed |
|---|---|---|
org.grails:grails-databindingMaven |
6.0.0 up to 6.1.0 | 6.1.0 |
org.grails:grails-databindingMaven |
5.0.0 up to 5.3.4 | 5.3.4 |
org.grails:grails-databindingMaven |
4.0.0 up to 4.1.3 | 4.1.3 |
org.grails:grails-databindingMaven |
2.0.0 up to 3.3.17 | 3.3.17 |
org.grails:grails-databindingTuxCare:Maven |
2.5.6 up to 2.5.6-tuxcare.1 | 2.5.6-tuxcare.1 |
org.grails:grails-databindingMaven |
5.0.0 up to 5.3.4, plus listed versions 5.0.15.0.25.0.35.1.05.1.1 Show 20 moreShow less5.1.105.1.25.1.35.1.45.1.55.1.65.1.75.1.85.1.95.2.05.2.15.2.25.2.35.2.45.2.55.2.65.3.05.3.15.3.25.3.3 |
5.3.4 |
org.grails:grails-databindingMaven |
4.0.0 up to 4.1.3, plus listed versions 4.0.14.0.104.0.114.0.124.0.13 Show 10 moreShow less4.0.54.0.64.0.74.0.84.0.94.1.04.1.0.M34.1.0.M44.1.14.1.2 |
4.1.3 |
org.grails:grails-databindingMaven |
2.0.0 up to 3.3.17, plus listed versions 2.3.02.3.0.M12.3.0.M22.3.0.RC12.3.0.RC2 Show 45 moreShow less2.3.12.3.102.3.112.3.22.3.32.3.42.3.52.3.62.3.72.3.82.3.92.4.02.4.0.M12.4.0.M22.4.0.RC12.4.0.RC22.4.12.4.22.4.32.4.42.4.52.5.02.5.12.5.22.5.32.5.42.5.52.5.63.0.03.0.0.M13.0.0.M23.0.0.RC23.0.0.RC33.0.13.0.103.0.113.0.123.0.133.0.143.0.153.0.163.0.173.0.33.0.43.0.5 |
3.3.17 |
History
| Recorded | Changed | Sources |
|---|---|---|
| aliases | EUVD | |
| first indexed | CVE List, GitHub Advisories, NVD, OSV |
Dates are when Every CVE recorded each change. Upstream dates may differ.
In short
CVE-2023-46131 is a medium vulnerability (CVSS 6.5) in Grails, published December 20, 2023. No source lists public exploit code. EPSS puts the chance of exploitation in the next 30 days at 0.72%, the 54th percentile. Fixed in org.grails:grails-databinding 6.1.0.
References
github.com/grails/grails-core/security/advisories/GHSA-3pjv-r7w4-2cf5
grails.org/blog/2023-12-20-cve-data-binding-dos.html
nvd.nist.gov/vuln/detail/CVE-2023-46131
Left out here: 48 versions. The JSON record has them.