{"id":"CVE-2026-40983","aliases":["EUVD-2026-35318","GHSA-w737-wx49-qj23","ROOT-APP-MAVEN-CVE-2026-40983"],"status":"published","title":"Micrometer gRPC server instrumentation DoS vulnerability","description":"In Micrometer, it is possible for a user to provide specially crafted gRPC requests that may cause a denial-of-service (DoS) condition.\n\nAffected versions:\nMicrometer 1.16.0 through 1.16.5; 1.15.0 through 1.15.11.","severity":{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"high","assessor":"cna","from":"cve"},"epss":{"day":"2026-11-10","score":0.00631,"percentile":0.50593,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":false,"fix_available":true},"cwes":["CWE-400","CWE-770"],"published":"2026-06-09T03:46:54Z","modified":"2026-09-22T12:15:07Z","fixes":[{"ecosystem":"Maven","package":"io.micrometer:micrometer-core","fixed_in":["1.16.6","1.15.12"],"sources":["ghsa","osv"]},{"ecosystem":"Root:Maven","package":"io.micrometer:micrometer-core","fixed_in":["1.16.0-aikido.1","1.16.5-aikido.1","1.15.11-aikido.1","1.16.4-aikido.2","1.15.10-aikido.3","1.16.4-aikido.1","1.15.10-aikido.1","1.15.10-aikido.2"],"sources":["osv"]},{"ecosystem":"Root:Maven","package":"io.root.io.micrometer:micrometer-core","fixed_in":["1.16.0-root.io.1","1.16.5-root.io.1","1.15.11-root.io.1","1.16.4-root.io.2","1.15.10-root.io.3","1.16.4-root.io.1","1.15.10-root.io.1","1.15.10-root.io.2"],"sources":["osv"]}],"affected":[{"source":"ghsa","ecosystem":"Maven","package":"io.micrometer:micrometer-core","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"1.16.0"},{"last_affected":"1.16.5"},{"fixed":"1.16.6"}]}]},{"source":"ghsa","ecosystem":"Maven","package":"io.micrometer:micrometer-core","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"1.15.0"},{"last_affected":"1.15.11"},{"fixed":"1.15.12"}]}]},{"source":"osv","ecosystem":"Maven","package":"io.micrometer:micrometer-core","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"1.16.0"},{"fixed":"1.16.6"}]}],"versions":["1.16.0","1.16.1","1.16.2","1.16.3","1.16.4","1.16.5"]},{"source":"osv","ecosystem":"Maven","package":"io.micrometer:micrometer-core","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"1.15.0"},{"fixed":"1.15.12"}]}],"versions":["1.15.0","1.15.1","1.15.10","1.15.11","1.15.2","1.15.3","1.15.4","1.15.5","1.15.6","1.15.7","1.15.8","1.15.9"]},{"source":"osv","ecosystem":"Root:Maven","package":"io.micrometer:micrometer-core","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.16.0-aikido.1"},{"fixed":"1.16.5-aikido.1"},{"fixed":"1.15.11-aikido.1"},{"fixed":"1.16.4-aikido.2"},{"fixed":"1.15.10-aikido.3"},{"fixed":"1.16.4-aikido.1"},{"fixed":"1.15.10-aikido.1"},{"fixed":"1.15.10-aikido.2"}]}]},{"source":"osv","ecosystem":"Root:Maven","package":"io.root.io.micrometer:micrometer-core","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.16.0-root.io.1"},{"fixed":"1.16.5-root.io.1"},{"fixed":"1.15.11-root.io.1"},{"fixed":"1.16.4-root.io.2"},{"fixed":"1.15.10-root.io.3"},{"fixed":"1.16.4-root.io.1"},{"fixed":"1.15.10-root.io.1"},{"fixed":"1.15.10-root.io.2"}]}]}],"products":[{"vendor":"red hat","product":"red hat amq broker 7.14.1"},{"vendor":"red hat","product":"red hat amq clients"},{"vendor":"red hat","product":"red hat build of apache camel - hawtio 4"},{"vendor":"red hat","product":"red hat build of apache camel 4 for quarkus 3"},{"vendor":"red hat","product":"red hat build of apache camel 4.18 for quarkus 3.33"},{"vendor":"red hat","product":"red hat build of apache camel for spring boot 4"},{"vendor":"red hat","product":"red hat build of apicurio registry 3"},{"vendor":"red hat","product":"red hat build of debezium 3"},{"vendor":"red hat","product":"red hat build of keycloak"},{"vendor":"red hat","product":"red hat build of keycloak 26.6"},{"vendor":"red hat","product":"red hat build of keycloak 26.6.5"},{"vendor":"red hat","product":"red hat data grid 8.6.2"},{"vendor":"red hat","product":"red hat fuse 7"},{"vendor":"red hat","product":"red hat jboss enterprise application platform expansion pack"},{"vendor":"red hat","product":"red hat openshift ai (rhoai)"},{"vendor":"red hat","product":"red hat openshift dev spaces"},{"vendor":"red hat","product":"red hat openshift dev spaces 3.30"},{"vendor":"red hat","product":"red hat satellite 6"},{"vendor":"red hat","product":"streams for apache kafka 2"},{"vendor":"red hat","product":"streams for apache kafka 3.2.1"},{"vendor":"spring","product":"micrometer"}],"references":[{"url":"https://spring.io/security/cve-2026-40983","tags":["web"]},{"url":"https://access.redhat.com/security/cve/CVE-2026-40983","tags":["vdb-entry","x_refsource_REDHAT","web"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2486697","tags":["issue-tracking","x_refsource_REDHAT","web"]},{"url":"https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-40983.json","tags":["x_sadp-csaf-vex","web"]},{"url":"https://access.redhat.com/errata/RHSA-2026:50849","tags":["vendor-advisory","x_refsource_REDHAT","web"]},{"url":"https://access.redhat.com/errata/RHSA-2026:66488","tags":["vendor-advisory","x_refsource_REDHAT","web"]},{"url":"https://access.redhat.com/errata/RHSA-2026:36839","tags":["vendor-advisory","x_refsource_REDHAT","web"]},{"url":"https://access.redhat.com/errata/RHSA-2026:41951","tags":["vendor-advisory","x_refsource_REDHAT","web"]},{"url":"https://access.redhat.com/errata/RHSA-2026:62260","tags":["vendor-advisory","x_refsource_REDHAT","web"]},{"url":"https://access.redhat.com/errata/RHSA-2026:50848","tags":["vendor-advisory","x_refsource_REDHAT","web"]},{"url":"https://access.redhat.com/errata/RHSA-2026:54435","tags":["vendor-advisory","x_refsource_REDHAT","web"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-40983","tags":["advisory"]},{"url":"https://github.com/advisories/GHSA-w737-wx49-qj23"},{"url":"https://github.com/micrometer-metrics/micrometer","tags":["package"]}],"sources":{"cve":[{"id":"CVE-2026-40983","title":"Micrometer gRPC server instrumentation DoS vulnerability","description":"In Micrometer, it is possible for a user to provide specially crafted gRPC requests that may cause a denial-of-service (DoS) condition.\n\nAffected versions:\nMicrometer 1.16.0 through 1.16.5; 1.15.0 through 1.15.11.","status":"published","published":"2026-06-09T03:46:54.131Z","modified":"2026-09-14T12:04:32.618Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"high","assessor":"cna"},{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"high","assessor":"adp"}],"cwes":["CWE-400","CWE-770"],"updated_at":"2026-11-02T13:43:11.445168Z"}],"euvd":[{"id":"EUVD-2026-35318","description":"In Micrometer, it is possible for a user to provide specially crafted gRPC requests that may cause a denial-of-service (DoS) condition.\n\nAffected versions:\nMicrometer 1.16.0 through 1.16.5; 1.15.0 through 1.15.11.","status":"published","published":"2026-06-09T03:46:54Z","modified":"2026-09-14T12:04:32Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"high"}],"updated_at":"2026-11-02T17:28:21.2136Z"}],"ghsa":[{"id":"GHSA-w737-wx49-qj23","title":"Micrometer gRPC server instrumentation DoS","description":"In Micrometer, it is possible for a user to provide specially crafted gRPC requests that may cause a denial-of-service (DoS) condition.\n\nAffected versions:\nMicrometer 1.16.0 through 1.16.5; 1.15.0 through 1.15.11.","status":"published","published":"2026-06-09T06:31:56Z","modified":"2026-09-11T15:32:18Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"high"}],"cwes":["CWE-400","CWE-770"],"updated_at":"2026-11-02T14:41:15.803194Z"}],"nvd":[{"id":"CVE-2026-40983","description":"In Micrometer, it is possible for a user to provide specially crafted gRPC requests that may cause a denial-of-service (DoS) condition.\n\nAffected versions:\nMicrometer 1.16.0 through 1.16.5; 1.15.0 through 1.15.11.","status":"published","published":"2026-06-09T05:16:34.653Z","modified":"2026-09-14T13:18:33.37Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"high","assessor":"secondary"},{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"high","assessor":"secondary"}],"cwes":["CWE-400","CWE-770"],"updated_at":"2026-11-02T14:12:22.73178Z"}],"osv":[{"id":"GHSA-w737-wx49-qj23","title":"Micrometer gRPC server instrumentation DoS","description":"In Micrometer, it is possible for a user to provide specially crafted gRPC requests that may cause a denial-of-service (DoS) condition.\n\nAffected versions:\nMicrometer 1.16.0 through 1.16.5; 1.15.0 through 1.15.11.","status":"published","published":"2026-06-09T06:31:56Z","modified":"2026-09-11T15:45:36.562871319Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"high"}],"cwes":["CWE-400","CWE-770"],"updated_at":"2026-11-02T15:46:58.401149Z"},{"id":"ROOT-APP-MAVEN-CVE-2026-40983","title":"CVE-2026-40983 in io.micrometer:micrometer-core - Patched by Root","description":"Root has patched CVE-2026-40983 in the io.micrometer:micrometer-core package for Root:Maven. Multiple fixed versions available.","status":"published","published":"2026-09-22T11:22:09Z","modified":"2026-09-22T12:15:07.755926573Z","updated_at":"2026-11-02T15:53:27.066589Z"}]}}