CVE-2026-59295
MediumCVSS 5.9Exploitation Probability (EPSS)
Low risk13th percentile - higher than 13% of all known CVEs
Summary
Outbound HTTP requests using a Micrometer-instrumented client can cause a denial-of-service (DoS) condition due to an unbounded memory leak. Affected versions include Micrometer 1.17.0, 1.16.0-1.16.6, 1.15.0-1.15.12, 1.14.0-1.14.16, and 1.9.18 and earlier.
Risk Assessment
An attacker could send many HTTP requests, leading to memory exhaustion and application crashes. This may cause service unavailability for users.
Recommendation
Update Micrometer to a patched version. Monitor memory usage and limit outbound request rates.
Other vulnerabilities in Micrometer
See all- CVE-2026-59296Medium
Using untrusted, non-normalized input as-is for metrics data (such as metric names, tag keys, or tag values) is a dangerous antipattern that general-purpose instrumentation should never perform. The vulnerability affects Micrometer versions 1.17.0, 1.16.0-1.16.6, 1.15.0-1.15.12, 1.14.0-1.14.16, and 1.9.18 and earlier.
- CVE-2026-40984High
A vulnerability in Micrometer allows remote denial of service (DoS) via specially crafted HTTP requests. Affects multiple versions of micrometer-core, micrometer-jetty11, and micrometer-jetty12.
- CVE-2026-40983High
In Micrometer, it is possible for a user to provide specially crafted gRPC requests that may cause a denial-of-service (DoS) condition. Affected versions: 1.16.0 through 1.16.5; 1.15.0 through 1.15.11.
Original NVD description (English source)
It is possible for outbound HTTP requests using a Micrometer-instrumented client to cause a denial-of-service (DoS) condition due to an unbounded memory leak. Micrometer 1.17.0 Micrometer 1.16.0 - 1.16.6 Micrometer 1.15.0 - 1.15.12 Micrometer 1.14.0 - 1.14.16 Micrometer 1.9.18 and earlier