CVE-2026-40983
Micrometer gRPC server instrumentation DoS vulnerability
In Micrometer, it is possible for a user to provide specially crafted gRPC requests that may cause a denial-of-service (DoS) condition.
Affected versions: Micrometer 1.16.0 through 1.16.5; 1.15.0 through 1.15.11.
Attack profile
How easy it is to exploit
- Attack vector
- Network
- Complexity
- Low
- Privileges needed
- None
- User interaction
- None
What an attacker can affect
- Confidentiality
- None
- Integrity
- None
- Availability
- High
Exploit likelihood
What each source reports
CVE List Score used
Micrometer gRPC server instrumentation DoS vulnerability
In Micrometer, it is possible for a user to provide specially crafted gRPC requests that may cause a denial-of-service (DoS) condition.
Affected versions: Micrometer 1.16.0 through 1.16.5; 1.15.0 through 1.15.11.
- Record
CVE-2026-40983- CVSS 3.1
- 7.5 High
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H - Weakness
- CWE-400, CWE-770
- Updated
- 2026-11-02
EUVDEUVD-2026-35318
In Micrometer, it is possible for a user to provide specially crafted gRPC requests that may cause a denial-of-service (DoS) condition.
Affected versions: Micrometer 1.16.0 through 1.16.5; 1.15.0 through 1.15.11.
- Record
EUVD-2026-35318- CVSS 3.1
- 7.5 High
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H - Updated
- 2026-11-02
GitHub AdvisoriesGHSA-w737-wx49-qj23
Micrometer gRPC server instrumentation DoS
In Micrometer, it is possible for a user to provide specially crafted gRPC requests that may cause a denial-of-service (DoS) condition.
Affected versions: Micrometer 1.16.0 through 1.16.5; 1.15.0 through 1.15.11.
- Record
GHSA-w737-wx49-qj23- CVSS 3.1
- 7.5 High
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H - Weakness
- CWE-400, CWE-770
- Updated
- 2026-11-02
NVD
In Micrometer, it is possible for a user to provide specially crafted gRPC requests that may cause a denial-of-service (DoS) condition.
Affected versions: Micrometer 1.16.0 through 1.16.5; 1.15.0 through 1.15.11.
- Record
CVE-2026-40983- CVSS 3.1
- 7.5 High
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H - Weakness
- CWE-400, CWE-770
- Updated
- 2026-11-02
OSVGHSA-w737-wx49-qj23
Micrometer gRPC server instrumentation DoS
In Micrometer, it is possible for a user to provide specially crafted gRPC requests that may cause a denial-of-service (DoS) condition.
Affected versions: Micrometer 1.16.0 through 1.16.5; 1.15.0 through 1.15.11.
- Record
GHSA-w737-wx49-qj23- CVSS 3.1
- 7.5 High
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H - Weakness
- CWE-400, CWE-770
- Updated
- 2026-11-02
OSVROOT-APP-MAVEN-CVE-2026-40983 No score
CVE-2026-40983 in io.micrometer:micrometer-core - Patched by Root
Root has patched CVE-2026-40983 in the io.micrometer:micrometer-core package for Root:Maven. Multiple fixed versions available.
- Record
ROOT-APP-MAVEN-CVE-2026-40983- Updated
- 2026-11-02
Affected products
- spring micrometer
- red hat amq broker 7.14.1
- red hat amq clients
- red hat build of apache camel - hawtio 4
- red hat build of apache camel 4 for quarkus 3
- red hat build of apache camel 4.18 for quarkus 3.33
- red hat build of apache camel for spring boot 4
- red hat build of apicurio registry 3
- red hat build of debezium 3
- red hat build of keycloak
- red hat build of keycloak 26.6
- red hat build of keycloak 26.6.5
Affected packages
| Package | Affected | Fixed |
|---|---|---|
io.micrometer:micrometer-coreMaven |
1.16.0 to 1.16.5 | 1.16.6 |
io.micrometer:micrometer-coreMaven |
1.15.0 to 1.15.11 | 1.15.12 |
io.micrometer:micrometer-coreMaven |
1.16.0 up to 1.16.6, plus listed versions 1.16.11.16.21.16.31.16.41.16.5 |
1.16.6 |
io.micrometer:micrometer-coreMaven |
1.15.0 up to 1.15.12, plus listed versions 1.15.11.15.101.15.111.15.21.15.3 Show 6 moreShow less1.15.41.15.51.15.61.15.71.15.81.15.9 |
1.15.12 |
io.micrometer:micrometer-coreRoot:Maven |
before 1.16.0-aikido.1 | 1.16.0-aikido.11.16.5-aikido.11.15.11-aikido.11.16.4-aikido.21.15.10-aikido.31.16.4-aikido.11.15.10-aikido.11.15.10-aikido.2 |
io.root.io.micrometer:micrometer-coreRoot:Maven |
before 1.16.0-root.io.1 | 1.16.0-root.io.11.16.5-root.io.11.15.11-root.io.11.16.4-root.io.21.15.10-root.io.31.16.4-root.io.11.15.10-root.io.11.15.10-root.io.2 |
History
| Recorded | Changed | Sources |
|---|---|---|
| first indexed | CVE List, EUVD, GitHub Advisories, NVD, OSV |
Dates are when Every CVE recorded each change. Upstream dates may differ.
In short
CVE-2026-40983 is a high vulnerability (CVSS 7.5) in Spring Micrometer, published June 9, 2026. No source lists public exploit code. EPSS puts the chance of exploitation in the next 30 days at 0.63%, the 50th percentile. Fixed in io.micrometer:micrometer-core 1.16.6.
References
spring.io/security/cve-2026-40983
access.redhat.com/security/cve/CVE-2026-40983
bugzilla.redhat.com/show_bug.cgi?id=2486697
security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-40983.json
Show 8 moreShow less
nvd.nist.gov/vuln/detail/CVE-2026-40983
github.com/advisories/GHSA-w737-wx49-qj23