Grails data binding causes JVM crash and/or other denial of service (CVE-2023-46131)

Grails data binding causes JVM crash and/or other denial of service (CVE-2023-46131) | HOL Guard CVE

Why this deserves its current priority

CVSS is 6.5. The current sources do not mark it as known exploited. Treat this as a source-backed prioritization signal, not a statement about your environment.

Analysis status

Analysis pending evidence review

Factual feed record only; HOL analysis is not approved for indexing. Read the methodology.

Affected scope and exposure questions

The current feed maps org.grails:grails-databinding (maven), org.grails:grails-databinding (maven), org.grails:grails-databinding (maven), org.grails:grails-databinding (maven). Check affected ranges and fixed versions before updating.

Mapped affected packages and fixed versions
Package	Affected range	Fixed version
org.grails:grails-databindingmaven	>=6.0.0 <6.1.0	6.1.0
org.grails:grails-databindingmaven	>=5.0.0 <5.3.4	5.3.4
org.grails:grails-databindingmaven	>=4.0.0 <4.1.3	4.1.3
org.grails:grails-databindingmaven	>=2.0.0 <3.3.17	3.3.17

Recommended response

Check inventory. Check lockfiles and deployed manifests for org.grails:grails-databinding, org.grails:grails-databinding, org.grails:grails-databinding.
Review the reported fix. Update org.grails:grails-databinding to 6.1.0; org.grails:grails-databinding to 5.3.4; org.grails:grails-databinding to 4.1.3; org.grails:grails-databinding to 3.3.17 if you use the affected versions. Test the change in a non-production environment first.

Evidence timeline and material changes

Published upstream
Dec 20, 2023
Evidence: source:osv:source_dates:source-dates:record
Source modified
Sep 10, 2026
Evidence: source:osv:source_dates:source-dates:record
First seen by HOL
Sep 10, 2026

Sources and claim methodology

Upstream source description

### Impact A specially crafted web request can lead to a JVM crash or denial of service. Any Grails framework application using Grails data binding is vulnerable. ### Patches Patches are available for Grails 3 and later. ### Workarounds No workaround is possible except to avoid data binding to request data. ### References - [Blog post](https://grails.org/blog/2023-12-20-cve-data-binding-dos.html) - [Discussion](https://github.com/grails/grails-core/issues/13302) - [Mitre CVD record](https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2023-46131)

Quoted source text, attributed separately from HOL analysis.