{"id":"CVE-2026-59323","state":"PUBLISHED","title":"Micrometer Tracing Brave Bridge W3C Baggage propagation DoS vulnerability","description":"An application using Micrometer Tracing with W3C baggage propagation in the Brave bridge is vulnerable to denial of service (DoS) due to unbounded object allocation when extracting incoming baggage headers.\nMicrometer Tracing 1.7.0\nMicrometer Tracing 1.6.0 - 1.6.6\nMicrometer Tracing 1.5.0 - 1.5.12\nMicrometer Tracing 1.4.13 and earlier","publishedAt":"2026-08-21T10:01:05.831Z","updatedAt":"2026-08-27T18:04:50.627Z","severity":{"score":5.3,"label":"Medium","version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L","source":"vmware"},"assigner":"vmware","products":["Spring Micrometer Tracing"],"affected":[{"vendor":"Spring","product":"Micrometer Tracing","defaultStatus":"unaffected","versions":[{"version":"1.7.0","status":"affected","versionType":"custom"},{"version":"1.6.0","status":"affected","lessThanOrEqual":"1.6.6","versionType":"custom"},{"version":"1.5.0","status":"affected","lessThanOrEqual":"1.5.12","versionType":"custom"},{"version":"0","status":"affected","lessThanOrEqual":"1.4.13","versionType":"custom"}]}],"references":["https://spring.io/security/cve-2026-59323"],"weaknesses":["CWE-770"],"ingestedAt":"2026-10-29T20:12:32.778Z","source":{"repository":"CVEProject/cvelistV5","path":"cves/2026/59xxx/CVE-2026-59323.json","commit":"556c9d3a8cd17e218bb8e452ba7cd619a384ff47"},"raw":{"dataType":"CVE_RECORD","dataVersion":"5.2","cveMetadata":{"cveId":"CVE-2026-59323","state":"PUBLISHED","datePublished":"2026-08-21T10:01:05.831Z","dateUpdated":"2026-08-27T18:04:50.627Z","assignerShortName":"vmware","assignerOrgId":"dcf2e128-44bd-42ed-91e8-88f912c1401d","dateReserved":"2026-07-04T18:14:10.167Z"},"containers":{"cna":{"title":"Micrometer Tracing Brave Bridge W3C Baggage propagation DoS vulnerability","descriptions":[{"lang":"en","value":"An application using Micrometer Tracing with W3C baggage propagation in the Brave bridge is vulnerable to denial of service (DoS) due to unbounded object allocation when extracting incoming baggage headers.\nMicrometer Tracing 1.7.0\nMicrometer Tracing 1.6.0 - 1.6.6\nMicrometer Tracing 1.5.0 - 1.5.12\nMicrometer Tracing 1.4.13 and earlier"}],"affected":[{"vendor":"Spring","product":"Micrometer Tracing","defaultStatus":"unaffected","versions":[{"version":"1.7.0","status":"affected","versionType":"custom"},{"version":"1.6.0","status":"affected","lessThanOrEqual":"1.6.6","versionType":"custom"},{"version":"1.5.0","status":"affected","lessThanOrEqual":"1.5.12","versionType":"custom"},{"version":"0","status":"affected","lessThanOrEqual":"1.4.13","versionType":"custom"}]}],"references":[{"url":"https://spring.io/security/cve-2026-59323"}],"metrics":[{"format":"CVSS","scenarios":[{"lang":"en","value":"GENERAL"}],"cvssV3_1":{"version":"3.1","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L","baseScore":5.3,"baseSeverity":"MEDIUM","attackVector":"NETWORK","attackComplexity":"LOW","privilegesRequired":"NONE","userInteraction":"NONE","scope":"UNCHANGED","confidentialityImpact":"NONE","integrityImpact":"NONE","availabilityImpact":"LOW"}}],"problemTypes":[{"descriptions":[{"lang":"en","description":"CWE-770 Allocation of Resources Without Limits or Throttling","type":"CWE"}]}],"providerMetadata":{"shortName":"vmware","orgId":"dcf2e128-44bd-42ed-91e8-88f912c1401d","dateUpdated":"2026-08-27T18:04:50.627Z"},"impacts":[{"descriptions":[{"lang":"en","value":"An application using Micrometer Tracing with W3C baggage propagation in the Brave bridge is vulnerable to denial of service (DoS) due to unbounded object allocation when extracting incoming baggage headers."}]}],"source":{"discovery":"UNKNOWN"}},"adp":[{"title":"CISA ADP Vulnrichment","metrics":[{"other":{"type":"ssvc","content":{"timestamp":"2026-08-21T12:03:29.254669Z","id":"CVE-2026-59323","options":[{"Exploitation":"none"},{"Automatable":"yes"},{"Technical Impact":"partial"}],"role":"CISA Coordinator","version":"2.0.3"}}}],"problemTypes":[{"descriptions":[{"cweId":"CWE-770","type":"CWE","lang":"en","description":"CWE-770 Allocation of Resources Without Limits or Throttling"}]}],"providerMetadata":{"shortName":"CISA-ADP","orgId":"134c704f-9b21-4f2e-91b3-4a467353bcc0","dateUpdated":"2026-08-21T16:44:48.719Z"}}]}}}