CVE-2026-40984
Micrometer HTTP server instrumentations DoS vulnerability
In Micrometer, it is possible for a user to provide specially crafted HTTP requests that may cause a denial-of-service (DoS) condition.
Affected versions: micrometer-core 1.16.0 through 1.16.5; 1.15.0 through 1.15.11; 1.14.0 through 1.14.15; 1.13.0 through 1.13.18; 1.9.0 through 1.9.17. micrometer-jetty11 1.16.0 through 1.16.5; 1.15.0 through 1.15.11; 1.14.0 through 1.14.15; 1.13.0 through 1.13.18. micrometer-jetty12 1.16.0 through 1.16.5; 1.15.0 through 1.15.11; 1.14.0 through 1.14.15; 1.13.0 through 1.13.18.
Attack profile
How easy it is to exploit
- Attack vector
- Network
- Complexity
- Low
- Privileges needed
- None
- User interaction
- None
What an attacker can affect
- Confidentiality
- None
- Integrity
- None
- Availability
- High
Exploit likelihood
What each source reports
CVE List Score used
Micrometer HTTP server instrumentations DoS vulnerability
In Micrometer, it is possible for a user to provide specially crafted HTTP requests that may cause a denial-of-service (DoS) condition.
Affected versions: micrometer-core 1.16.0 through 1.16.5; 1.15.0 through 1.15.11; 1.14.0 through 1.14.15; 1.13.0 through 1.13.18; 1.9.0 through 1.9.17. micrometer-jetty11 1.16.0 through 1.16.5; 1.15.0 through 1.15.11; 1.14.0 through 1.14.15; 1.13.0 through 1.13.18. micrometer-jetty12 1.16.0 through 1.16.5; 1.15.0 through 1.15.11; 1.14.0 through 1.14.15; 1.13.0 through 1.13.18.
- Record
CVE-2026-40984- CVSS 3.1
- 7.5 High
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H - Weakness
- CWE-400, CWE-770
- Updated
- 2026-11-02
EUVDEUVD-2026-35320
In Micrometer, it is possible for a user to provide specially crafted HTTP requests that may cause a denial-of-service (DoS) condition.
Affected versions: micrometer-core 1.16.0 through 1.16.5; 1.15.0 through 1.15.11; 1.14.0 through 1.14.15; 1.13.0 through 1.13.18; 1.9.0 through 1.9.17. micrometer-jetty11 1.16.0 through 1.16.5; 1.15.0 through 1.15.11; 1.14.0 through 1.14.15; 1.13.0 through 1.13.18. micrometer-jetty12 1.16.0 through 1.16.5; 1.15.0 through 1.15.11; 1.14.0 through 1.14.15; 1.13.0 through 1.13.18.
- Record
EUVD-2026-35320- CVSS 3.1
- 7.5 High
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H - Updated
- 2026-11-02
GitHub AdvisoriesGHSA-g3pr-3p32-fp23
Micrometer HTTP server instrumentations DoS
In Micrometer, it is possible for a user to provide specially crafted HTTP requests that may cause a denial-of-service (DoS) condition.
Affected versions: micrometer-core 1.16.0 through 1.16.5; 1.15.0 through 1.15.11; 1.14.0 through 1.14.15; 1.13.0 through 1.13.18; 1.9.0 through 1.9.17. micrometer-jetty11 1.16.0 through 1.16.5; 1.15.0 through 1.15.11; 1.14.0 through 1.14.15; 1.13.0 through 1.13.18. micrometer-jetty12 1.16.0 through 1.16.5; 1.15.0 through 1.15.11; 1.14.0 through 1.14.15; 1.13.0 through 1.13.18.
- Record
GHSA-g3pr-3p32-fp23- CVSS 3.1
- 7.5 High
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H - Weakness
- CWE-400, CWE-770
- Updated
- 2026-11-02
NVD
In Micrometer, it is possible for a user to provide specially crafted HTTP requests that may cause a denial-of-service (DoS) condition.
Affected versions: micrometer-core 1.16.0 through 1.16.5; 1.15.0 through 1.15.11; 1.14.0 through 1.14.15; 1.13.0 through 1.13.18; 1.9.0 through 1.9.17. micrometer-jetty11 1.16.0 through 1.16.5; 1.15.0 through 1.15.11; 1.14.0 through 1.14.15; 1.13.0 through 1.13.18. micrometer-jetty12 1.16.0 through 1.16.5; 1.15.0 through 1.15.11; 1.14.0 through 1.14.15; 1.13.0 through 1.13.18.
- Record
CVE-2026-40984- CVSS 3.1
- 7.5 High
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H - Weakness
- CWE-400, CWE-770
- Updated
- 2026-11-02
OSVGHSA-g3pr-3p32-fp23
Micrometer HTTP server instrumentations DoS
In Micrometer, it is possible for a user to provide specially crafted HTTP requests that may cause a denial-of-service (DoS) condition.
Affected versions: micrometer-core 1.16.0 through 1.16.5; 1.15.0 through 1.15.11; 1.14.0 through 1.14.15; 1.13.0 through 1.13.18; 1.9.0 through 1.9.17. micrometer-jetty11 1.16.0 through 1.16.5; 1.15.0 through 1.15.11; 1.14.0 through 1.14.15; 1.13.0 through 1.13.18. micrometer-jetty12 1.16.0 through 1.16.5; 1.15.0 through 1.15.11; 1.14.0 through 1.14.15; 1.13.0 through 1.13.18.
- Record
GHSA-g3pr-3p32-fp23- CVSS 3.1
- 7.5 High
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H - Weakness
- CWE-400, CWE-770
- Updated
- 2026-11-02
OSVCLSA-2026-1789228075 No score
TuxCare security update for io.micrometer (1 CVE)
TuxCare rebuilt 3 io.micrometer packages to address 1 CVE. Fixed in 1.13.15-tuxcare.1.
- Record
CLSA-2026-1789228075- Updated
- 2026-11-02
OSVCLSA-2026-1791901525 No score
TuxCare security update for io.micrometer:micrometer-core (3 CVEs)
TuxCare rebuilt io.micrometer:micrometer-core to address 3 CVEs. Fixed in 1.12.13-tuxcare.1.
- Record
CLSA-2026-1791901525- Updated
- 2026-11-02
OSVCLSA-2026-1792000121 No score
TuxCare security update for io.micrometer (3 CVEs)
TuxCare rebuilt 3 io.micrometer packages to address 3 CVEs. Fixed in 1.12.12-tuxcare.1.
- Record
CLSA-2026-1792000121- Updated
- 2026-11-02
OSVROOT-APP-MAVEN-CVE-2026-40984 No score
CVE-2026-40984 in io.micrometer:micrometer-core - Patched by Root
Root has patched CVE-2026-40984 in the io.micrometer:micrometer-core package for Root:Maven. Multiple fixed versions available.
- Record
ROOT-APP-MAVEN-CVE-2026-40984- Updated
- 2026-11-03
Affected products
- spring micrometer
- red hat amq broker 7.13.6
- red hat amq broker 7.14.1
- red hat amq clients
- red hat build of apache camel - hawtio 4
- red hat build of apache camel 4 for quarkus 3
- red hat build of apache camel 4.18 for quarkus 3.33
- red hat build of apache camel 4.18.1.p1 for spring boot 3.5.16
- red hat build of apicurio registry 3
- red hat build of debezium 3
- red hat build of keycloak 26.6
- red hat build of keycloak 26.6.5
Show 10 moreShow less
- red hat build of optaplanner 8
- red hat data grid 8.6.2
- red hat fuse 7
- red hat jboss enterprise application platform expansion pack
- red hat openshift ai (rhoai)
- red hat openshift dev spaces
- red hat openshift dev spaces 3.30
- red hat process automation 7
- red hat streams for apache kafka 2
- red hat streams for apache kafka 3.2.1
Affected packages
| Package | Affected | Fixed |
|---|---|---|
io.micrometer:micrometer-coreMaven |
1.16.0 to 1.16.5 | 1.16.6 |
io.micrometer:micrometer-coreMaven |
1.15.0 to 1.15.11 | 1.15.12 |
io.micrometer:micrometer-coreMaven |
1.14.0 to 1.14.14 | None known |
io.micrometer:micrometer-coreMaven |
1.10.0 to 1.13.15 | None known |
io.micrometer:micrometer-coreMaven |
through 1.9.17 | None known |
io.micrometer:micrometer-jetty12Maven |
1.16.0 to 1.16.5 | 1.16.6 |
io.micrometer:micrometer-jetty12Maven |
1.15.0 to 1.15.11 | 1.15.12 |
io.micrometer:micrometer-jetty12Maven |
1.14.0 to 1.14.14 | None known |
io.micrometer:micrometer-jetty12Maven |
through 1.13.15 | None known |
io.micrometer:micrometer-jetty11Maven |
1.16.0 to 1.16.5 | 1.16.6 |
Show 29 moreShow less
| Package | Affected | Fixed |
|---|---|---|
io.micrometer:micrometer-jetty11Maven |
1.15.0 to 1.15.11 | 1.15.12 |
io.micrometer:micrometer-jetty11Maven |
1.14.0 to 1.14.14 | None known |
io.micrometer:micrometer-jetty11Maven |
through 1.13.15 | None known |
io.micrometer:micrometer-coreTuxCare:Maven |
1.13.15 up to 1.13.15-tuxcare.1 | 1.13.15-tuxcare.1 |
io.micrometer:micrometer-jetty11TuxCare:Maven |
1.13.15 up to 1.13.15-tuxcare.1 | 1.13.15-tuxcare.1 |
io.micrometer:micrometer-jetty12TuxCare:Maven |
1.13.15 up to 1.13.15-tuxcare.1 | 1.13.15-tuxcare.1 |
io.micrometer:micrometer-coreTuxCare:Maven From an advisory covering 3 CVEs |
1.12.13 up to 1.12.13-tuxcare.1 | 1.12.13-tuxcare.1 |
io.micrometer:micrometer-coreTuxCare:Maven From an advisory covering 3 CVEs |
1.12.12 up to 1.12.12-tuxcare.1 | 1.12.12-tuxcare.1 |
io.micrometer:micrometer-jetty11TuxCare:Maven From an advisory covering 3 CVEs |
1.12.12 up to 1.12.12-tuxcare.1 | 1.12.12-tuxcare.1 |
io.micrometer:micrometer-registry-statsdTuxCare:Maven From an advisory covering 3 CVEs |
1.12.12 up to 1.12.12-tuxcare.1 | 1.12.12-tuxcare.1 |
io.micrometer:micrometer-coreMaven |
1.16.0 up to 1.16.6, plus listed versions 1.16.11.16.21.16.31.16.41.16.5 |
1.16.6 |
io.micrometer:micrometer-coreMaven |
1.15.0 up to 1.15.12, plus listed versions 1.15.11.15.101.15.111.15.21.15.3 Show 6 moreShow less1.15.41.15.51.15.61.15.71.15.81.15.9 |
1.15.12 |
io.micrometer:micrometer-coreMaven |
1.14.0 to 1.14.14, plus listed versions 1.14.11.14.101.14.111.14.121.14.13 Show 8 moreShow less1.14.21.14.31.14.41.14.51.14.61.14.71.14.81.14.9 |
None known |
io.micrometer:micrometer-coreMaven |
1.10.0 to 1.13.15, plus listed versions 1.10.11.10.101.10.111.10.121.10.13 Show 45 moreShow less1.10.21.10.31.10.41.10.51.10.61.10.71.10.81.10.91.11.01.11.11.11.101.11.111.11.121.11.21.11.31.11.41.11.51.11.61.11.71.11.81.11.91.12.01.12.11.12.101.12.111.12.121.12.131.12.21.12.31.12.41.12.51.12.61.12.71.12.81.12.91.13.01.13.11.13.101.13.111.13.121.13.131.13.141.13.21.13.31.13.4 |
None known |
io.micrometer:micrometer-coreMaven |
through 1.9.17, plus listed versions 0.10.0.RELEASE0.11.0.RELEASE0.12.0.RELEASE0.6.3.RELEASE0.7.0.RELEASE Show 45 moreShow less0.8.0.RELEASE0.9.0.RELEASE0.9.1.RELEASE0.9.2.RELEASE1.0.01.0.0-rc.11.0.0-rc.21.0.0-rc.31.0.0-rc.41.0.0-rc.51.0.0-rc.61.0.0-rc.71.0.0-rc.81.0.0-rc.91.0.11.0.101.0.111.0.21.0.31.0.41.0.51.0.61.0.71.0.81.0.91.1.01.1.11.1.101.1.111.1.121.1.131.1.141.1.151.1.161.1.171.1.181.1.191.1.21.1.31.1.41.1.51.1.61.1.71.1.81.1.9 |
None known |
io.micrometer:micrometer-jetty12Maven |
1.16.0 up to 1.16.6, plus listed versions 1.16.11.16.21.16.31.16.41.16.5 |
1.16.6 |
io.micrometer:micrometer-jetty12Maven |
1.15.0 up to 1.15.12, plus listed versions 1.15.11.15.101.15.111.15.21.15.3 Show 6 moreShow less1.15.41.15.51.15.61.15.71.15.81.15.9 |
1.15.12 |
io.micrometer:micrometer-jetty12Maven |
1.14.0 to 1.14.14, plus listed versions 1.14.11.14.101.14.111.14.121.14.13 Show 8 moreShow less1.14.21.14.31.14.41.14.51.14.61.14.71.14.81.14.9 |
None known |
io.micrometer:micrometer-jetty12Maven |
through 1.13.15, plus listed versions 1.13.01.13.11.13.101.13.111.13.12 Show 10 moreShow less1.13.131.13.141.13.21.13.31.13.41.13.51.13.61.13.71.13.81.13.9 |
None known |
io.micrometer:micrometer-jetty11Maven |
1.16.0 up to 1.16.6, plus listed versions 1.16.11.16.21.16.31.16.41.16.5 |
1.16.6 |
io.micrometer:micrometer-jetty11Maven |
1.15.0 up to 1.15.12, plus listed versions 1.15.11.15.101.15.111.15.21.15.3 Show 6 moreShow less1.15.41.15.51.15.61.15.71.15.81.15.9 |
1.15.12 |
io.micrometer:micrometer-jetty11Maven |
1.14.0 to 1.14.14, plus listed versions 1.14.11.14.101.14.111.14.121.14.13 Show 8 moreShow less1.14.21.14.31.14.41.14.51.14.61.14.71.14.81.14.9 |
None known |
io.micrometer:micrometer-jetty11Maven |
through 1.13.15, plus listed versions 1.10.01.10.11.10.101.10.111.10.12 Show 45 moreShow less1.10.131.10.21.10.31.10.41.10.51.10.61.10.71.10.81.10.91.11.01.11.11.11.101.11.111.11.121.11.21.11.31.11.41.11.51.11.61.11.71.11.81.11.91.12.01.12.11.12.101.12.111.12.121.12.131.12.21.12.31.12.41.12.51.12.61.12.71.12.81.12.91.13.01.13.11.13.101.13.111.13.121.13.131.13.141.13.21.13.3 |
None known |
io.micrometer:micrometer-coreRoot:Maven |
before 1.9.4-aikido.1 | 1.9.4-aikido.11.10.0-aikido.11.11.5-aikido.11.16.0-aikido.11.14.3-aikido.11.16.5-aikido.11.15.11-aikido.11.9.1-aikido.11.9.4-aikido.21.16.4-aikido.21.15.10-aikido.31.16.4-aikido.11.15.10-aikido.21.14.5-aikido.11.13.4-aikido.11.7.6-aikido.11.14.4-aikido.1 |
io.micrometer:micrometer-jetty11Root:Maven |
before 1.12.0-aikido.1 | 1.12.0-aikido.11.16.4-aikido.11.13.4-aikido.1 |
io.micrometer:micrometer-jetty12Root:Maven |
before 1.13.4-aikido.1 | 1.13.4-aikido.1 |
io.root.io.micrometer:micrometer-coreRoot:Maven |
before 1.9.4-root.io.1 | 1.9.4-root.io.11.10.0-root.io.11.11.5-root.io.11.16.0-root.io.11.14.3-root.io.11.16.5-root.io.11.15.11-root.io.11.9.1-root.io.11.9.4-root.io.21.16.4-root.io.21.15.10-root.io.31.16.4-root.io.11.15.10-root.io.21.14.5-root.io.11.13.4-root.io.11.7.6-root.io.11.14.4-root.io.1 |
io.root.io.micrometer:micrometer-jetty11Root:Maven |
before 1.12.0-root.io.1 | 1.12.0-root.io.11.16.4-root.io.11.13.4-root.io.11.15.10-root.io.3 |
io.root.io.micrometer:micrometer-jetty12Root:Maven |
before 1.16.4-root.io.2 | 1.16.4-root.io.21.15.10-root.io.31.13.4-root.io.1 |
History
| Recorded | Changed | Sources |
|---|---|---|
| affected, facts | ||
| affected | OSV | |
| affected | OSV | |
| first indexed | CVE List, EUVD, GitHub Advisories, NVD, OSV |
Dates are when Every CVE recorded each change. Upstream dates may differ.
In short
CVE-2026-40984 is a high vulnerability (CVSS 7.5) in Spring Micrometer, published June 9, 2026. No source lists public exploit code. EPSS puts the chance of exploitation in the next 30 days at 0.79%, the 56th percentile. Fixed in io.micrometer:micrometer-core 1.16.6.
References
spring.io/security/cve-2026-40984
access.redhat.com/security/cve/CVE-2026-40984
bugzilla.redhat.com/show_bug.cgi?id=2486716
security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-40984.json
Show 11 moreShow less
nvd.nist.gov/vuln/detail/CVE-2026-40984
github.com/micrometer-metrics/micrometer/commit/36da131525228188a36779a28471a76c79213dd4
Left out here: 113 versions. The JSON record has them.