In `JsonBeanPropertyBinder::expandArrayToThreshold` in `io.micronaut:micronaut-json-core` before Micronaut 4 4.10.16 and in Micronaut 3 before 3.10.5 does not correctly handle descending array index order during form-urlencoded body binding, which allows remote attackers to cause a denial of service (non-terminating loop, CPU exhaustion, and OutOfMemoryError) via crafted indexed form parameters (e.g., `authors[1].name` followed by `authors[0].name`). ### Example With such an application ```java package dosform; import io.micronaut.http.HttpResponse; import io.micronaut.http.MediaType; import io.micronaut.http.annotation.Body; import io.micronaut.http.annotation.Consumes; import io.micronaut.http.annotation.Controller; import io.micronaut.http.annotation.Get; import io.micronaut.http.annotation.Post; import io.micronaut.http.annotation.Produces; import java.net.URI; @Controller class HomeController { @Produces(MediaType.TEXT_HTML) @Get String index() { return """ """; } @Consumes(MediaType.APPLICATION_FORM_URLENCODED) @Post("/submit") HttpResponse submit(@Body Book book) { return HttpResponse.seeOther(URI.create("/")); } } package dosform; import io.micronaut.core.annotation.Introspected; import java.util.Objects; @I