CVE-2026-40983
HighCVSS 7.5Exploitation Probability (EPSS)
Low risk43th percentile - higher than 43% of all known CVEs
Summary
In Micrometer, it is possible for a user to provide specially crafted gRPC requests that may cause a denial-of-service (DoS) condition. Affected versions: 1.16.0 through 1.16.5; 1.15.0 through 1.15.11.
Risk Assessment
An attacker can cause unavailability of applications using Micrometer for monitoring, disrupting IT systems and hindering problem diagnosis.
Recommendation
Update Micrometer to version 1.16.6 or later (or 1.15.12+). If an update is not possible, restrict access to gRPC endpoints.
Other vulnerabilities in Micrometer
See all- CVE-2026-59295Medium
Outbound HTTP requests using a Micrometer-instrumented client can cause a denial-of-service (DoS) condition due to an unbounded memory leak. Affected versions include Micrometer 1.17.0, 1.16.0-1.16.6, 1.15.0-1.15.12, 1.14.0-1.14.16, and 1.9.18 and earlier.
- CVE-2026-59296Medium
Using untrusted, non-normalized input as-is for metrics data (such as metric names, tag keys, or tag values) is a dangerous antipattern that general-purpose instrumentation should never perform. The vulnerability affects Micrometer versions 1.17.0, 1.16.0-1.16.6, 1.15.0-1.15.12, 1.14.0-1.14.16, and 1.9.18 and earlier.
- CVE-2026-40984High
A vulnerability in Micrometer allows remote denial of service (DoS) via specially crafted HTTP requests. Affects multiple versions of micrometer-core, micrometer-jetty11, and micrometer-jetty12.
Original NVD description (English source)
In Micrometer, it is possible for a user to provide specially crafted gRPC requests that may cause a denial-of-service (DoS) condition. Affected versions: Micrometer 1.16.0 through 1.16.5; 1.15.0 through 1.15.11.