{"id":"CVE-2026-40984","state":"PUBLISHED","title":"Micrometer HTTP server instrumentations DoS vulnerability","description":"In Micrometer, it is possible for a user to provide specially crafted HTTP requests that may cause a denial-of-service (DoS) condition.\n\nAffected versions:\nmicrometer-core 1.16.0 through 1.16.5; 1.15.0 through 1.15.11; 1.14.0 through 1.14.15; 1.13.0 through 1.13.18; 1.9.0 through 1.9.17.\nmicrometer-jetty11 1.16.0 through 1.16.5; 1.15.0 through 1.15.11; 1.14.0 through 1.14.15; 1.13.0 through 1.13.18.\nmicrometer-jetty12 1.16.0 through 1.16.5; 1.15.0 through 1.15.11; 1.14.0 through 1.14.15; 1.13.0 through 1.13.18.","publishedAt":"2026-06-09T03:47:46.447Z","updatedAt":"2026-09-14T12:04:26.346Z","severity":{"score":7.5,"label":"High","version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","source":"vmware"},"assigner":"vmware","products":["Spring Micrometer"],"affected":[{"vendor":"Spring","product":"Micrometer","packageName":"micrometer-core","defaultStatus":"unaffected","versions":[{"version":"1.16.0","status":"affected","lessThan":"1.16.5.1","versionType":"custom"},{"version":"1.15.0","status":"affected","lessThan":"1.15.11.1","versionType":"custom"},{"version":"1.14.0","status":"affected","lessThan":"1.14.16","versionType":"custom"},{"version":"1.13.0","status":"affected","lessThan":"1.13.19","versionType":"custom"},{"version":"1.9.0","status":"affected","lessThan":"1.9.18","versionType":"custom"}]},{"vendor":"Spring","product":"Micrometer","packageName":"micrometer-jetty11","defaultStatus":"unaffected","versions":[{"version":"1.16.0","status":"affected","lessThan":"1.16.5.1","versionType":"custom"},{"version":"1.15.0","status":"affected","lessThan":"1.15.11.1","versionType":"custom"},{"version":"1.14.0","status":"affected","lessThan":"1.14.16","versionType":"custom"},{"version":"1.13.0","status":"affected","lessThan":"1.13.19","versionType":"custom"}]},{"vendor":"Spring","product":"Micrometer","packageName":"micrometer-jetty12","defaultStatus":"unaffected","versions":[{"version":"1.16.0","status":"affected","lessThan":"1.16.6","versionType":"custom"},{"version":"1.15.0","status":"affected","lessThan":"1.15.11.","versionType":"custom"},{"version":"1.14.0","status":"affected","lessThan":"1.14.15.1","versionType":"custom"},{"version":"1.13.0","status":"affected","lessThan":"1.13.19","versionType":"custom"}]}],"references":["https://spring.io/security/cve-2026-40984","https://access.redhat.com/security/cve/CVE-2026-40984","https://bugzilla.redhat.com/show_bug.cgi?id=2486716","https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-40984.json","https://access.redhat.com/errata/RHSA-2026:50849","https://access.redhat.com/errata/RHSA-2026:66545","https://access.redhat.com/errata/RHSA-2026:66488","https://access.redhat.com/errata/RHSA-2026:36839","https://access.redhat.com/errata/RHSA-2026:41951","https://access.redhat.com/errata/RHSA-2026:62260","https://access.redhat.com/errata/RHSA-2026:37390","https://access.redhat.com/errata/RHSA-2026:50848","https://access.redhat.com/errata/RHSA-2026:54435"],"weaknesses":["CWE-400","CWE-770"],"ingestedAt":"2026-10-29T20:11:57.932Z","source":{"repository":"CVEProject/cvelistV5","path":"cves/2026/40xxx/CVE-2026-40984.json","commit":"556c9d3a8cd17e218bb8e452ba7cd619a384ff47"},"raw":{"dataType":"CVE_RECORD","dataVersion":"5.2","cveMetadata":{"cveId":"CVE-2026-40984","state":"PUBLISHED","datePublished":"2026-06-09T03:47:46.447Z","dateUpdated":"2026-09-14T12:04:26.346Z","assignerShortName":"vmware","assignerOrgId":"dcf2e128-44bd-42ed-91e8-88f912c1401d","dateReserved":"2026-04-16T02:19:09.388Z"},"containers":{"cna":{"title":"Micrometer HTTP server instrumentations DoS vulnerability","descriptions":[{"lang":"en","value":"In Micrometer, it is possible for a user to provide specially crafted HTTP requests that may cause a denial-of-service (DoS) condition.\n\nAffected versions:\nmicrometer-core 1.16.0 through 1.16.5; 1.15.0 through 1.15.11; 1.14.0 through 1.14.15; 1.13.0 through 1.13.18; 1.9.0 through 1.9.17.\nmicrometer-jetty11 1.16.0 through 1.16.5; 1.15.0 through 1.15.11; 1.14.0 through 1.14.15; 1.13.0 through 1.13.18.\nmicrometer-jetty12 1.16.0 through 1.16.5; 1.15.0 through 1.15.11; 1.14.0 through 1.14.15; 1.13.0 through 1.13.18."}],"affected":[{"vendor":"Spring","product":"Micrometer","packageName":"micrometer-core","defaultStatus":"unaffected","versions":[{"version":"1.16.0","status":"affected","lessThan":"1.16.5.1","versionType":"custom"},{"version":"1.15.0","status":"affected","lessThan":"1.15.11.1","versionType":"custom"},{"version":"1.14.0","status":"affected","lessThan":"1.14.16","versionType":"custom"},{"version":"1.13.0","status":"affected","lessThan":"1.13.19","versionType":"custom"},{"version":"1.9.0","status":"affected","lessThan":"1.9.18","versionType":"custom"}]},{"vendor":"Spring","product":"Micrometer","packageName":"micrometer-jetty11","defaultStatus":"unaffected","versions":[{"version":"1.16.0","status":"affected","lessThan":"1.16.5.1","versionType":"custom"},{"version":"1.15.0","status":"affected","lessThan":"1.15.11.1","versionType":"custom"},{"version":"1.14.0","status":"affected","lessThan":"1.14.16","versionType":"custom"},{"version":"1.13.0","status":"affected","lessThan":"1.13.19","versionType":"custom"}]},{"vendor":"Spring","product":"Micrometer","packageName":"micrometer-jetty12","defaultStatus":"unaffected","versions":[{"version":"1.16.0","status":"affected","lessThan":"1.16.6","versionType":"custom"},{"version":"1.15.0","status":"affected","lessThan":"1.15.11.","versionType":"custom"},{"version":"1.14.0","status":"affected","lessThan":"1.14.15.1","versionType":"custom"},{"version":"1.13.0","status":"affected","lessThan":"1.13.19","versionType":"custom"}]}],"references":[{"url":"https://spring.io/security/cve-2026-40984"}],"metrics":[{"format":"CVSS","scenarios":[{"lang":"en","value":"GENERAL"}],"cvssV3_1":{"version":"3.1","attackVector":"NETWORK","attackComplexity":"LOW","privilegesRequired":"NONE","userInteraction":"NONE","scope":"UNCHANGED","confidentialityImpact":"NONE","integrityImpact":"NONE","availabilityImpact":"HIGH","baseSeverity":"HIGH","baseScore":7.5,"vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H"}}],"problemTypes":[{"descriptions":[{"cweId":"CWE-400","lang":"en","description":"CWE-400: Uncontrolled Resource Consumption","type":"CWE"}]}],"providerMetadata":{"shortName":"vmware","orgId":"dcf2e128-44bd-42ed-91e8-88f912c1401d","dateUpdated":"2026-06-23T20:06:22.279Z"},"impacts":[{"descriptions":[{"lang":"en","value":"An unauthenticated remote attacker can cause denial of service by sending specially crafted HTTP requests that trigger excessive resource consumption in applications using Micrometer HTTP server instrumentations."}]}],"source":{"discovery":"UNKNOWN"},"x_generator":{"engine":"Vulnogram 1.0.1"}},"adp":[{"title":"CISA ADP Vulnrichment","metrics":[{"other":{"type":"ssvc","content":{"timestamp":"2026-06-09T13:49:55.899071Z","id":"CVE-2026-40984","options":[{"Exploitation":"none"},{"Automatable":"yes"},{"Technical Impact":"partial"}],"role":"CISA Coordinator","version":"2.0.3"}}}],"providerMetadata":{"shortName":"CISA-ADP","orgId":"134c704f-9b21-4f2e-91b3-4a467353bcc0","dateUpdated":"2026-06-09T13:50:04.966Z"}},{"title":"micrometer-core: micrometer-jetty11: micrometer-jetty12: Micrometer: Denial of Service via specially crafted HTTP requests","descriptions":[{"lang":"en","value":"A flaw was found in Micrometer. A remote attacker can provide specially crafted HTTP requests, which may lead to a denial-of-service (DoS) condition. This vulnerability allows an attacker to disrupt the availability of the affected system."}],"affected":[{"vendor":"Red Hat","product":"Red Hat AMQ Broker 7.13.6","packageName":"micrometer-core","defaultStatus":"unaffected","collectionURL":"https://access.redhat.com/downloads/content/package-browser/","cpes":["cpe:/a:redhat:amq_broker:7.13"]},{"vendor":"Red Hat","product":"Red Hat AMQ Broker 7.14.1","packageName":"micrometer-core","defaultStatus":"unaffected","collectionURL":"https://access.redhat.com/downloads/content/package-browser/","cpes":["cpe:/a:redhat:amq_broker:7.14"]},{"vendor":"Red Hat","product":"Red Hat build of Apache Camel 4.18.1.P1 for Spring Boot 3.5.16","packageName":"micrometer-core","defaultStatus":"unaffected","collectionURL":"https://access.redhat.com/downloads/content/package-browser/","cpes":["cpe:/a:redhat:apache_camel_spring_boot:4.18"]},{"vendor":"Red Hat","product":"Red Hat Build of Apache Camel 4.18 for Quarkus 3.33","packageName":"micrometer-core","defaultStatus":"unaffected","collectionURL":"https://access.redhat.com/downloads/content/package-browser/","cpes":["cpe:/a:redhat:apache_camel_quarkus:3.33"]},{"vendor":"Red Hat","product":"Red Hat build of Keycloak 26.6","packageName":"rhbk/keycloak-operator-bundle","defaultStatus":"affected","versions":[{"version":"26.6.5-1","status":"unaffected","lessThan":"*","versionType":"rpm"}],"collectionURL":"https://catalog.redhat.com/software/containers/","cpes":["cpe:/a:redhat:build_keycloak:26.6::el9"]},{"vendor":"Red Hat","product":"Red Hat build of Keycloak 26.6","packageName":"rhbk/keycloak-rhel9","defaultStatus":"affected","versions":[{"version":"26.6-11","status":"unaffected","lessThan":"*","versionType":"rpm"}],"collectionURL":"https://catalog.redhat.com/software/containers/","cpes":["cpe:/a:redhat:build_keycloak:26.6::el9"]},{"vendor":"Red Hat","product":"Red Hat build of Keycloak 26.6","packageName":"rhbk/keycloak-rhel9-operator","defaultStatus":"affected","versions":[{"version":"26.6-11","status":"unaffected","lessThan":"*","versionType":"rpm"}],"collectionURL":"https://catalog.redhat.com/software/containers/","cpes":["cpe:/a:redhat:build_keycloak:26.6::el9"]},{"vendor":"Red Hat","product":"Red Hat build of Keycloak 26.6.5","packageName":"micrometer-core","defaultStatus":"unaffected","collectionURL":"https://access.redhat.com/downloads/content/package-browser/","cpes":["cpe:/a:redhat:build_keycloak:26.6::el9"]},{"vendor":"Red Hat","product":"Red Hat build of Keycloak 26.6.5","packageName":"rhbk/keycloak-rhel9","defaultStatus":"unaffected","collectionURL":"https://access.redhat.com/downloads/content/package-browser/","cpes":["cpe:/a:redhat:build_keycloak:26.6::el9"]},{"vendor":"Red Hat","product":"Red Hat build of Keycloak 26.6.5","packageName":"rhbk/keycloak","defaultStatus":"affected","versions":[{"version":"rhel9-operator","status":"unaffected","lessThan":"*","versionType":"rpm"}],"collectionURL":"https://access.redhat.com/downloads/content/package-browser/","cpes":["cpe:/a:redhat:build_keycloak:26.6::el9"]},{"vendor":"Red Hat","product":"Red Hat build of Keycloak 26.6.5","packageName":"rhbk-openshift-rhel9/rhbk","defaultStatus":"affected","versions":[{"version":"openshift-rhel9","status":"unaffected","lessThan":"*","versionType":"rpm"}],"collectionURL":"https://access.redhat.com/downloads/content/package-browser/","cpes":["cpe:/a:redhat:build_keycloak:26.6::el9"]},{"vendor":"Red Hat","product":"Red Hat build of Keycloak 26.6.5","packageName":"rhbk-rhel9-operator/rhbk","defaultStatus":"affected","versions":[{"version":"rhel9-operator","status":"unaffected","lessThan":"*","versionType":"rpm"}],"collectionURL":"https://access.redhat.com/downloads/content/package-browser/","cpes":["cpe:/a:redhat:build_keycloak:26.6::el9"]},{"vendor":"Red Hat","product":"Red Hat Data Grid 8.6.2","packageName":"micrometer-core","defaultStatus":"unaffected","collectionURL":"https://access.redhat.com/downloads/content/package-browser/","cpes":["cpe:/a:redhat:jboss_data_grid:8"]},{"vendor":"Red Hat","product":"Streams for Apache Kafka 3.2.1","packageName":"micrometer-core","defaultStatus":"unaffected","collectionURL":"https://access.redhat.com/downloads/content/package-browser/","cpes":["cpe:/a:redhat:amq_streams:3.2::el9"]},{"vendor":"Red Hat","product":"Red Hat OpenShift Dev Spaces 3.30","packageName":"devspaces/openvsx-rhel9","defaultStatus":"affected","versions":[{"version":"1787759145","status":"unaffected","lessThan":"*","versionType":"rpm"}],"collectionURL":"https://catalog.redhat.com/software/containers/","cpes":["cpe:/a:redhat:openshift_devspaces:3.30::el9"]},{"vendor":"Red Hat","product":"Red Hat OpenShift Dev Spaces 3.30","packageName":"devspaces/pluginregistry-rhel9","defaultStatus":"affected","versions":[{"version":"1787759723","status":"unaffected","lessThan":"*","versionType":"rpm"}],"collectionURL":"https://catalog.redhat.com/software/containers/","cpes":["cpe:/a:redhat:openshift_devspaces:3.30::el9"]},{"vendor":"Red Hat","product":"Red Hat AMQ Clients","packageName":"micrometer-core","defaultStatus":"affected","collectionURL":"https://access.redhat.com/downloads/content/package-browser/","cpes":["cpe:/a:redhat:amq_clients:2023"]},{"vendor":"Red Hat","product":"Red Hat build of Apache Camel 4 for Quarkus 3","packageName":"micrometer-core","defaultStatus":"affected","collectionURL":"https://access.redhat.com/downloads/content/package-browser/","cpes":["cpe:/a:redhat:camel_quarkus:3"]},{"vendor":"Red Hat","product":"Red Hat build of Apache Camel - HawtIO 4","packageName":"micrometer-core","defaultStatus":"affected","collectionURL":"https://access.redhat.com/downloads/content/package-browser/","cpes":["cpe:/a:redhat:apache_camel_hawtio:4"]},{"vendor":"Red Hat","product":"Red Hat build of Apicurio Registry 3","packageName":"micrometer-core","defaultStatus":"affected","collectionURL":"https://access.redhat.com/downloads/content/package-browser/","cpes":["cpe:/a:redhat:apicurio_registry:3"]},{"vendor":"Red Hat","product":"Red Hat build of Debezium 3","packageName":"micrometer-core","defaultStatus":"affected","collectionURL":"https://access.redhat.com/downloads/content/package-browser/","cpes":["cpe:/a:redhat:debezium:3"]},{"vendor":"Red Hat","product":"Red Hat build of OptaPlanner 8","packageName":"micrometer-core","defaultStatus":"affected","collectionURL":"https://access.redhat.com/downloads/content/package-browser/","cpes":["cpe:/a:redhat:optaplanner:::el6"]},{"vendor":"Red Hat","product":"Red Hat Fuse 7","packageName":"micrometer-core","defaultStatus":"unknown","collectionURL":"https://access.redhat.com/downloads/content/package-browser/","cpes":["cpe:/a:redhat:jboss_fuse:7"]},{"vendor":"Red Hat","product":"Red Hat JBoss Enterprise Application Platform Expansion Pack","packageName":"micrometer-core","defaultStatus":"affected","collectionURL":"https://access.redhat.com/downloads/content/package-browser/","cpes":["cpe:/a:redhat:jbosseapxp"]},{"vendor":"Red Hat","product":"Red Hat OpenShift AI (RHOAI)","packageName":"rhoai/odh-trustyai-service-rhel9","defaultStatus":"unaffected","collectionURL":"https://access.redhat.com/downloads/content/package-browser/","cpes":["cpe:/a:redhat:openshift_ai"]},{"vendor":"Red Hat","product":"Red Hat OpenShift Dev Spaces","packageName":"devspaces/server-rhel9","defaultStatus":"unknown","collectionURL":"https://access.redhat.com/downloads/content/package-browser/","cpes":["cpe:/a:redhat:openshift_devspaces:3"]},{"vendor":"Red Hat","product":"Red Hat Process Automation 7","packageName":"micrometer-core","defaultStatus":"affected","collectionURL":"https://access.redhat.com/downloads/content/package-browser/","cpes":["cpe:/a:redhat:jboss_enterprise_bpms_platform:7"]},{"vendor":"Red Hat","product":"streams for Apache Kafka 2","packageName":"micrometer-core","defaultStatus":"affected","collectionURL":"https://access.redhat.com/downloads/content/package-browser/","cpes":["cpe:/a:redhat:amq_streams:2"]}],"references":[{"url":"https://access.redhat.com/security/cve/CVE-2026-40984","tags":["vdb-entry","x_refsource_REDHAT"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2486716","name":"RHBZ#2486716","tags":["issue-tracking","x_refsource_REDHAT"]},{"url":"https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-40984.json","tags":["x_sadp-csaf-vex"]},{"url":"https://access.redhat.com/errata/RHSA-2026:50849","tags":["vendor-advisory","x_refsource_REDHAT"]},{"url":"https://access.redhat.com/errata/RHSA-2026:66545","tags":["vendor-advisory","x_refsource_REDHAT"]},{"url":"https://access.redhat.com/errata/RHSA-2026:66488","tags":["vendor-advisory","x_refsource_REDHAT"]},{"url":"https://access.redhat.com/errata/RHSA-2026:36839","tags":["vendor-advisory","x_refsource_REDHAT"]},{"url":"https://access.redhat.com/errata/RHSA-2026:41951","tags":["vendor-advisory","x_refsource_REDHAT"]},{"url":"https://access.redhat.com/errata/RHSA-2026:62260","tags":["vendor-advisory","x_refsource_REDHAT"]},{"url":"https://access.redhat.com/errata/RHSA-2026:37390","tags":["vendor-advisory","x_refsource_REDHAT"]},{"url":"https://access.redhat.com/errata/RHSA-2026:50848","tags":["vendor-advisory","x_refsource_REDHAT"]},{"url":"https://access.redhat.com/errata/RHSA-2026:54435","tags":["vendor-advisory","x_refsource_REDHAT"]}],"metrics":[{"other":{"content":{"namespace":"https://access.redhat.com/security/updates/classification/","value":"Important"},"type":"Red Hat severity rating"}},{"cvssV3_1":{"attackComplexity":"LOW","attackVector":"NETWORK","availabilityImpact":"HIGH","baseScore":7.5,"baseSeverity":"HIGH","confidentialityImpact":"NONE","integrityImpact":"NONE","privilegesRequired":"NONE","scope":"UNCHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","version":"3.1"},"format":"CVSS"}],"problemTypes":[{"descriptions":[{"cweId":"CWE-770","description":"Allocation of Resources Without Limits or Throttling","lang":"en","type":"CWE"}]}],"providerMetadata":{"shortName":"redhat-SADP","orgId":"0b0ca135-0b70-47e7-9f44-1890c2a1c46c","dateUpdated":"2026-09-14T12:04:26.346Z"},"datePublic":"2026-06-09T03:47:46.447Z","solutions":[{"lang":"en","value":"RHSA-2026:50849: Red Hat build of Keycloak 26.6"},{"lang":"en","value":"RHSA-2026:66545: Red Hat AMQ Broker 7.13.6"},{"lang":"en","value":"RHSA-2026:66488: Red Hat AMQ Broker 7.14.1"},{"lang":"en","value":"RHSA-2026:36839: Red Hat Build of Apache Camel 4.18 for Quarkus 3.33"},{"lang":"en","value":"RHSA-2026:41951: Red Hat Data Grid 8.6.2"},{"lang":"en","value":"RHSA-2026:62260: Red Hat OpenShift Dev Spaces 3.30"},{"lang":"en","value":"RHSA-2026:37390: Red Hat build of Apache Camel 4.18.1.P1 for Spring Boot 3.5.16"},{"lang":"en","value":"RHSA-2026:50848: Red Hat build of Keycloak 26.6.5"},{"lang":"en","value":"RHSA-2026:54435: Streams for Apache Kafka 3.2.1"}],"timeline":[{"lang":"en","time":"2026-06-09T05:01:51.700Z","value":"Reported to Red Hat."},{"lang":"en","time":"2026-06-09T03:47:46.447Z","value":"Made public."}],"x_adpType":"supplier","x_generator":{"engine":"sadp-cli 1.0.0"}}]}}}