CVE-2026-40984
HighCVSS 7.5Exploitation Probability (EPSS)
Elevated risk52th percentile - higher than 52% of all known CVEs
Summary
A vulnerability in Micrometer allows remote denial of service (DoS) via specially crafted HTTP requests. Affects multiple versions of micrometer-core, micrometer-jetty11, and micrometer-jetty12.
Risk Assessment
An attacker can remotely overload an application using Micrometer, causing service unavailability.
Recommendation
Update Micrometer to version 1.16.6, 1.15.12, 1.14.16, 1.13.19, or 1.9.18 (depending on the branch used).
Other vulnerabilities in Micrometer
See all- CVE-2026-59295Medium
Outbound HTTP requests using a Micrometer-instrumented client can cause a denial-of-service (DoS) condition due to an unbounded memory leak. Affected versions include Micrometer 1.17.0, 1.16.0-1.16.6, 1.15.0-1.15.12, 1.14.0-1.14.16, and 1.9.18 and earlier.
- CVE-2026-59296Medium
Using untrusted, non-normalized input as-is for metrics data (such as metric names, tag keys, or tag values) is a dangerous antipattern that general-purpose instrumentation should never perform. The vulnerability affects Micrometer versions 1.17.0, 1.16.0-1.16.6, 1.15.0-1.15.12, 1.14.0-1.14.16, and 1.9.18 and earlier.
- CVE-2026-40983High
In Micrometer, it is possible for a user to provide specially crafted gRPC requests that may cause a denial-of-service (DoS) condition. Affected versions: 1.16.0 through 1.16.5; 1.15.0 through 1.15.11.
Original NVD description (English source)
In Micrometer, it is possible for a user to provide specially crafted HTTP requests that may cause a denial-of-service (DoS) condition. Affected versions: micrometer-core 1.16.0 through 1.16.5; 1.15.0 through 1.15.11; 1.14.0 through 1.14.15; 1.13.0 through 1.13.18; 1.9.0 through 1.9.17. micrometer-jetty11 1.16.0 through 1.16.5; 1.15.0 through 1.15.11; 1.14.0 through 1.14.15; 1.13.0 through 1.13.18. micrometer-jetty12 1.16.0 through 1.16.5; 1.15.0 through 1.15.11; 1.14.0 through 1.14.15; 1.13.0 through 1.13.18.