{"id":"CVE-2026-40984","aliases":["CLSA-2026-1789228075","CLSA-2026-1791901525","CLSA-2026-1792000121","EUVD-2026-35320","GHSA-g3pr-3p32-fp23","ROOT-APP-MAVEN-CVE-2026-40984"],"status":"published","title":"Micrometer HTTP server instrumentations DoS vulnerability","description":"In Micrometer, it is possible for a user to provide specially crafted HTTP requests that may cause a denial-of-service (DoS) condition.\n\nAffected versions:\nmicrometer-core 1.16.0 through 1.16.5; 1.15.0 through 1.15.11; 1.14.0 through 1.14.15; 1.13.0 through 1.13.18; 1.9.0 through 1.9.17.\nmicrometer-jetty11 1.16.0 through 1.16.5; 1.15.0 through 1.15.11; 1.14.0 through 1.14.15; 1.13.0 through 1.13.18.\nmicrometer-jetty12 1.16.0 through 1.16.5; 1.15.0 through 1.15.11; 1.14.0 through 1.14.15; 1.13.0 through 1.13.18.","severity":{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"high","assessor":"cna","from":"cve"},"epss":{"day":"2026-11-10","score":0.00792,"percentile":0.5665,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":false,"fix_available":true},"cwes":["CWE-400","CWE-770"],"published":"2026-06-09T03:47:46Z","modified":"2026-11-03T11:15:10Z","fixes":[{"ecosystem":"Maven","package":"io.micrometer:micrometer-core","fixed_in":["1.16.6","1.15.12"],"sources":["ghsa","osv"]},{"ecosystem":"Maven","package":"io.micrometer:micrometer-jetty12","fixed_in":["1.16.6","1.15.12"],"sources":["ghsa","osv"]},{"ecosystem":"Maven","package":"io.micrometer:micrometer-jetty11","fixed_in":["1.16.6","1.15.12"],"sources":["ghsa","osv"]},{"ecosystem":"TuxCare:Maven","package":"io.micrometer:micrometer-core","fixed_in":["1.13.15-tuxcare.1"],"sources":["osv"]},{"ecosystem":"TuxCare:Maven","package":"io.micrometer:micrometer-jetty11","fixed_in":["1.13.15-tuxcare.1"],"sources":["osv"]},{"ecosystem":"TuxCare:Maven","package":"io.micrometer:micrometer-jetty12","fixed_in":["1.13.15-tuxcare.1"],"sources":["osv"]},{"ecosystem":"Root:Maven","package":"io.micrometer:micrometer-core","fixed_in":["1.9.4-aikido.1","1.10.0-aikido.1","1.11.5-aikido.1","1.16.0-aikido.1","1.14.3-aikido.1","1.16.5-aikido.1","1.15.11-aikido.1","1.9.1-aikido.1","1.9.4-aikido.2","1.16.4-aikido.2","1.15.10-aikido.3","1.16.4-aikido.1","1.15.10-aikido.2","1.14.5-aikido.1","1.13.4-aikido.1","1.7.6-aikido.1","1.14.4-aikido.1"],"sources":["osv"]},{"ecosystem":"Root:Maven","package":"io.micrometer:micrometer-jetty11","fixed_in":["1.12.0-aikido.1","1.16.4-aikido.1","1.13.4-aikido.1"],"sources":["osv"]},{"ecosystem":"Root:Maven","package":"io.micrometer:micrometer-jetty12","fixed_in":["1.13.4-aikido.1"],"sources":["osv"]},{"ecosystem":"Root:Maven","package":"io.root.io.micrometer:micrometer-core","fixed_in":["1.9.4-root.io.1","1.10.0-root.io.1","1.11.5-root.io.1","1.16.0-root.io.1","1.14.3-root.io.1","1.16.5-root.io.1","1.15.11-root.io.1","1.9.1-root.io.1","1.9.4-root.io.2","1.16.4-root.io.2","1.15.10-root.io.3","1.16.4-root.io.1","1.15.10-root.io.2","1.14.5-root.io.1","1.13.4-root.io.1","1.7.6-root.io.1","1.14.4-root.io.1"],"sources":["osv"]},{"ecosystem":"Root:Maven","package":"io.root.io.micrometer:micrometer-jetty11","fixed_in":["1.12.0-root.io.1","1.16.4-root.io.1","1.13.4-root.io.1","1.15.10-root.io.3"],"sources":["osv"]},{"ecosystem":"Root:Maven","package":"io.root.io.micrometer:micrometer-jetty12","fixed_in":["1.16.4-root.io.2","1.15.10-root.io.3","1.13.4-root.io.1"],"sources":["osv"]}],"affected":[{"source":"ghsa","ecosystem":"Maven","package":"io.micrometer:micrometer-core","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"1.16.0"},{"last_affected":"1.16.5"},{"fixed":"1.16.6"}]}]},{"source":"ghsa","ecosystem":"Maven","package":"io.micrometer:micrometer-core","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"1.15.0"},{"last_affected":"1.15.11"},{"fixed":"1.15.12"}]}]},{"source":"ghsa","ecosystem":"Maven","package":"io.micrometer:micrometer-core","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"1.14.0"},{"last_affected":"1.14.14"}]}]},{"source":"ghsa","ecosystem":"Maven","package":"io.micrometer:micrometer-core","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"1.10.0"},{"last_affected":"1.13.15"}]}]},{"source":"ghsa","ecosystem":"Maven","package":"io.micrometer:micrometer-core","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"last_affected":"1.9.17"}]}]},{"source":"ghsa","ecosystem":"Maven","package":"io.micrometer:micrometer-jetty12","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"1.16.0"},{"last_affected":"1.16.5"},{"fixed":"1.16.6"}]}]},{"source":"ghsa","ecosystem":"Maven","package":"io.micrometer:micrometer-jetty12","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"1.15.0"},{"last_affected":"1.15.11"},{"fixed":"1.15.12"}]}]},{"source":"ghsa","ecosystem":"Maven","package":"io.micrometer:micrometer-jetty12","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"1.14.0"},{"last_affected":"1.14.14"}]}]},{"source":"ghsa","ecosystem":"Maven","package":"io.micrometer:micrometer-jetty12","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"last_affected":"1.13.15"}]}]},{"source":"ghsa","ecosystem":"Maven","package":"io.micrometer:micrometer-jetty11","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"1.16.0"},{"last_affected":"1.16.5"},{"fixed":"1.16.6"}]}]},{"source":"ghsa","ecosystem":"Maven","package":"io.micrometer:micrometer-jetty11","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"1.15.0"},{"last_affected":"1.15.11"},{"fixed":"1.15.12"}]}]},{"source":"ghsa","ecosystem":"Maven","package":"io.micrometer:micrometer-jetty11","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"1.14.0"},{"last_affected":"1.14.14"}]}]},{"source":"ghsa","ecosystem":"Maven","package":"io.micrometer:micrometer-jetty11","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"last_affected":"1.13.15"}]}]},{"source":"osv","ecosystem":"TuxCare:Maven","package":"io.micrometer:micrometer-core","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"1.13.15"},{"fixed":"1.13.15-tuxcare.1"}]}],"versions":["1.13.15"]},{"source":"osv","ecosystem":"TuxCare:Maven","package":"io.micrometer:micrometer-jetty11","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"1.13.15"},{"fixed":"1.13.15-tuxcare.1"}]}],"versions":["1.13.15"]},{"source":"osv","ecosystem":"TuxCare:Maven","package":"io.micrometer:micrometer-jetty12","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"1.13.15"},{"fixed":"1.13.15-tuxcare.1"}]}],"versions":["1.13.15"]},{"source":"osv","ecosystem":"TuxCare:Maven","package":"io.micrometer:micrometer-core","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"1.12.13"},{"fixed":"1.12.13-tuxcare.1"}]}],"versions":["1.12.13"],"bundled":3},{"source":"osv","ecosystem":"TuxCare:Maven","package":"io.micrometer:micrometer-core","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"1.12.12"},{"fixed":"1.12.12-tuxcare.1"}]}],"versions":["1.12.12"],"bundled":3},{"source":"osv","ecosystem":"TuxCare:Maven","package":"io.micrometer:micrometer-jetty11","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"1.12.12"},{"fixed":"1.12.12-tuxcare.1"}]}],"versions":["1.12.12"],"bundled":3},{"source":"osv","ecosystem":"TuxCare:Maven","package":"io.micrometer:micrometer-registry-statsd","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"1.12.12"},{"fixed":"1.12.12-tuxcare.1"}]}],"versions":["1.12.12"],"bundled":3},{"source":"osv","ecosystem":"Maven","package":"io.micrometer:micrometer-core","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"1.16.0"},{"fixed":"1.16.6"}]}],"versions":["1.16.0","1.16.1","1.16.2","1.16.3","1.16.4","1.16.5"]},{"source":"osv","ecosystem":"Maven","package":"io.micrometer:micrometer-core","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"1.15.0"},{"fixed":"1.15.12"}]}],"versions":["1.15.0","1.15.1","1.15.10","1.15.11","1.15.2","1.15.3","1.15.4","1.15.5","1.15.6","1.15.7","1.15.8","1.15.9"]},{"source":"osv","ecosystem":"Maven","package":"io.micrometer:micrometer-core","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"1.14.0"},{"last_affected":"1.14.14"}]}],"versions":["1.14.0","1.14.1","1.14.10","1.14.11","1.14.12","1.14.13","1.14.14","1.14.2","1.14.3","1.14.4","1.14.5","1.14.6","1.14.7","1.14.8","1.14.9"]},{"source":"osv","ecosystem":"Maven","package":"io.micrometer:micrometer-core","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"1.10.0"},{"last_affected":"1.13.15"}]}],"versions":["1.10.0","1.10.1","1.10.10","1.10.11","1.10.12","1.10.13","1.10.2","1.10.3","1.10.4","1.10.5","1.10.6","1.10.7","1.10.8","1.10.9","1.11.0","1.11.1","1.11.10","1.11.11","1.11.12","1.11.2","1.11.3","1.11.4","1.11.5","1.11.6","1.11.7","1.11.8","1.11.9","1.12.0","1.12.1","1.12.10","1.12.11","1.12.12","1.12.13","1.12.2","1.12.3","1.12.4","1.12.5","1.12.6","1.12.7","1.12.8","1.12.9","1.13.0","1.13.1","1.13.10","1.13.11","1.13.12","1.13.13","1.13.14","1.13.15","1.13.2","1.13.3","1.13.4","1.13.5","1.13.6","1.13.7","1.13.8","1.13.9"]},{"source":"osv","ecosystem":"Maven","package":"io.micrometer:micrometer-core","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"last_affected":"1.9.17"}]}],"versions":["0.10.0.RELEASE","0.11.0.RELEASE","0.12.0.RELEASE","0.6.3.RELEASE","0.7.0.RELEASE","0.8.0.RELEASE","0.9.0.RELEASE","0.9.1.RELEASE","0.9.2.RELEASE","1.0.0","1.0.0-rc.1","1.0.0-rc.2","1.0.0-rc.3","1.0.0-rc.4","1.0.0-rc.5","1.0.0-rc.6","1.0.0-rc.7","1.0.0-rc.8","1.0.0-rc.9","1.0.1","1.0.10","1.0.11","1.0.2","1.0.3","1.0.4","1.0.5","1.0.6","1.0.7","1.0.8","1.0.9","1.1.0","1.1.1","1.1.10","1.1.11","1.1.12","1.1.13","1.1.14","1.1.15","1.1.16","1.1.17","1.1.18","1.1.19","1.1.2","1.1.3","1.1.4","1.1.5","1.1.6","1.1.7","1.1.8","1.1.9","1.2.0","1.2.1","1.2.2","1.3.0","1.3.1","1.3.10","1.3.11","1.3.12","1.3.14","1.3.15","1.3.16","1.3.17","1.3.18","1.3.19","1.3.2","1.3.20","1.3.3","1.3.4","1.3.5","1.3.6","1.3.7","1.3.8","1.3.9","1.4.0","1.4.1","1.4.2","1.5.0","1.5.1","1.5.10","1.5.11","1.5.12","1.5.13","1.5.14","1.5.15","1.5.16","1.5.17","1.5.2","1.5.3","1.5.4","1.5.5","1.5.6","1.5.7","1.5.8","1.5.9","1.6.0","1.6.1","1.6.10","1.6.11","1.6.12","1.6.13","1.6.2","1.6.3","1.6.4","1.6.5","1.6.6","1.6.7","1.6.8","1.6.9","1.7.0","1.7.1","1.7.10","1.7.11","1.7.12","1.7.2","1.7.3","1.7.4","1.7.5","1.7.6","1.7.7","1.7.8","1.7.9","1.8.0","1.8.1","1.8.10","1.8.11","1.8.12","1.8.13","1.8.2","1.8.3","1.8.4","1.8.5","1.8.6","1.8.7","1.8.8","1.8.9","1.9.0","1.9.1","1.9.10","1.9.11","1.9.12","1.9.13","1.9.14","1.9.15","1.9.16","1.9.17","1.9.2","1.9.3","1.9.4","1.9.5","1.9.6","1.9.7","1.9.8","1.9.9"]},{"source":"osv","ecosystem":"Maven","package":"io.micrometer:micrometer-jetty12","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"1.16.0"},{"fixed":"1.16.6"}]}],"versions":["1.16.0","1.16.1","1.16.2","1.16.3","1.16.4","1.16.5"]},{"source":"osv","ecosystem":"Maven","package":"io.micrometer:micrometer-jetty12","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"1.15.0"},{"fixed":"1.15.12"}]}],"versions":["1.15.0","1.15.1","1.15.10","1.15.11","1.15.2","1.15.3","1.15.4","1.15.5","1.15.6","1.15.7","1.15.8","1.15.9"]},{"source":"osv","ecosystem":"Maven","package":"io.micrometer:micrometer-jetty12","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"1.14.0"},{"last_affected":"1.14.14"}]}],"versions":["1.14.0","1.14.1","1.14.10","1.14.11","1.14.12","1.14.13","1.14.14","1.14.2","1.14.3","1.14.4","1.14.5","1.14.6","1.14.7","1.14.8","1.14.9"]},{"source":"osv","ecosystem":"Maven","package":"io.micrometer:micrometer-jetty12","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"last_affected":"1.13.15"}]}],"versions":["1.13.0","1.13.1","1.13.10","1.13.11","1.13.12","1.13.13","1.13.14","1.13.15","1.13.2","1.13.3","1.13.4","1.13.5","1.13.6","1.13.7","1.13.8","1.13.9"]},{"source":"osv","ecosystem":"Maven","package":"io.micrometer:micrometer-jetty11","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"1.16.0"},{"fixed":"1.16.6"}]}],"versions":["1.16.0","1.16.1","1.16.2","1.16.3","1.16.4","1.16.5"]},{"source":"osv","ecosystem":"Maven","package":"io.micrometer:micrometer-jetty11","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"1.15.0"},{"fixed":"1.15.12"}]}],"versions":["1.15.0","1.15.1","1.15.10","1.15.11","1.15.2","1.15.3","1.15.4","1.15.5","1.15.6","1.15.7","1.15.8","1.15.9"]},{"source":"osv","ecosystem":"Maven","package":"io.micrometer:micrometer-jetty11","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"1.14.0"},{"last_affected":"1.14.14"}]}],"versions":["1.14.0","1.14.1","1.14.10","1.14.11","1.14.12","1.14.13","1.14.14","1.14.2","1.14.3","1.14.4","1.14.5","1.14.6","1.14.7","1.14.8","1.14.9"]},{"source":"osv","ecosystem":"Maven","package":"io.micrometer:micrometer-jetty11","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"last_affected":"1.13.15"}]}],"versions":["1.10.0","1.10.1","1.10.10","1.10.11","1.10.12","1.10.13","1.10.2","1.10.3","1.10.4","1.10.5","1.10.6","1.10.7","1.10.8","1.10.9","1.11.0","1.11.1","1.11.10","1.11.11","1.11.12","1.11.2","1.11.3","1.11.4","1.11.5","1.11.6","1.11.7","1.11.8","1.11.9","1.12.0","1.12.1","1.12.10","1.12.11","1.12.12","1.12.13","1.12.2","1.12.3","1.12.4","1.12.5","1.12.6","1.12.7","1.12.8","1.12.9","1.13.0","1.13.1","1.13.10","1.13.11","1.13.12","1.13.13","1.13.14","1.13.15","1.13.2","1.13.3","1.13.4","1.13.5","1.13.6","1.13.7","1.13.8","1.13.9"]},{"source":"osv","ecosystem":"Root:Maven","package":"io.micrometer:micrometer-core","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.9.4-aikido.1"},{"fixed":"1.10.0-aikido.1"},{"fixed":"1.11.5-aikido.1"},{"fixed":"1.16.0-aikido.1"},{"fixed":"1.14.3-aikido.1"},{"fixed":"1.16.5-aikido.1"},{"fixed":"1.15.11-aikido.1"},{"fixed":"1.9.1-aikido.1"},{"fixed":"1.9.4-aikido.2"},{"fixed":"1.16.4-aikido.2"},{"fixed":"1.15.10-aikido.3"},{"fixed":"1.16.4-aikido.1"},{"fixed":"1.15.10-aikido.2"},{"fixed":"1.14.5-aikido.1"},{"fixed":"1.13.4-aikido.1"},{"fixed":"1.7.6-aikido.1"},{"fixed":"1.14.4-aikido.1"}]}]},{"source":"osv","ecosystem":"Root:Maven","package":"io.micrometer:micrometer-jetty11","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.12.0-aikido.1"},{"fixed":"1.16.4-aikido.1"},{"fixed":"1.13.4-aikido.1"}]}]},{"source":"osv","ecosystem":"Root:Maven","package":"io.micrometer:micrometer-jetty12","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.13.4-aikido.1"}]}]},{"source":"osv","ecosystem":"Root:Maven","package":"io.root.io.micrometer:micrometer-core","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.9.4-root.io.1"},{"fixed":"1.10.0-root.io.1"},{"fixed":"1.11.5-root.io.1"},{"fixed":"1.16.0-root.io.1"},{"fixed":"1.14.3-root.io.1"},{"fixed":"1.16.5-root.io.1"},{"fixed":"1.15.11-root.io.1"},{"fixed":"1.9.1-root.io.1"},{"fixed":"1.9.4-root.io.2"},{"fixed":"1.16.4-root.io.2"},{"fixed":"1.15.10-root.io.3"},{"fixed":"1.16.4-root.io.1"},{"fixed":"1.15.10-root.io.2"},{"fixed":"1.14.5-root.io.1"},{"fixed":"1.13.4-root.io.1"},{"fixed":"1.7.6-root.io.1"},{"fixed":"1.14.4-root.io.1"}]}]},{"source":"osv","ecosystem":"Root:Maven","package":"io.root.io.micrometer:micrometer-jetty11","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.12.0-root.io.1"},{"fixed":"1.16.4-root.io.1"},{"fixed":"1.13.4-root.io.1"},{"fixed":"1.15.10-root.io.3"}]}]},{"source":"osv","ecosystem":"Root:Maven","package":"io.root.io.micrometer:micrometer-jetty12","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.16.4-root.io.2"},{"fixed":"1.15.10-root.io.3"},{"fixed":"1.13.4-root.io.1"}]}]}],"products":[{"vendor":"red hat","product":"red hat amq broker 7.13.6"},{"vendor":"red hat","product":"red hat amq broker 7.14.1"},{"vendor":"red hat","product":"red hat amq clients"},{"vendor":"red hat","product":"red hat build of apache camel - hawtio 4"},{"vendor":"red hat","product":"red hat build of apache camel 4 for quarkus 3"},{"vendor":"red hat","product":"red hat build of apache camel 4.18 for quarkus 3.33"},{"vendor":"red hat","product":"red hat build of apache camel 4.18.1.p1 for spring boot 3.5.16"},{"vendor":"red hat","product":"red hat build of apicurio registry 3"},{"vendor":"red hat","product":"red hat build of debezium 3"},{"vendor":"red hat","product":"red hat build of keycloak 26.6"},{"vendor":"red hat","product":"red hat build of keycloak 26.6.5"},{"vendor":"red hat","product":"red hat build of optaplanner 8"},{"vendor":"red hat","product":"red hat data grid 8.6.2"},{"vendor":"red hat","product":"red hat fuse 7"},{"vendor":"red hat","product":"red hat jboss enterprise application platform expansion pack"},{"vendor":"red hat","product":"red hat openshift ai (rhoai)"},{"vendor":"red hat","product":"red hat openshift dev spaces"},{"vendor":"red hat","product":"red hat openshift dev spaces 3.30"},{"vendor":"red hat","product":"red hat process automation 7"},{"vendor":"red hat","product":"streams for apache kafka 2"},{"vendor":"red hat","product":"streams for apache kafka 3.2.1"},{"vendor":"spring","product":"micrometer"}],"references":[{"url":"https://spring.io/security/cve-2026-40984","tags":["web"]},{"url":"https://access.redhat.com/security/cve/CVE-2026-40984","tags":["vdb-entry","x_refsource_REDHAT","web"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2486716","tags":["issue-tracking","x_refsource_REDHAT","web"]},{"url":"https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-40984.json","tags":["x_sadp-csaf-vex","web"]},{"url":"https://access.redhat.com/errata/RHSA-2026:50849","tags":["vendor-advisory","x_refsource_REDHAT","web"]},{"url":"https://access.redhat.com/errata/RHSA-2026:66545","tags":["vendor-advisory","x_refsource_REDHAT","web"]},{"url":"https://access.redhat.com/errata/RHSA-2026:66488","tags":["vendor-advisory","x_refsource_REDHAT","web"]},{"url":"https://access.redhat.com/errata/RHSA-2026:36839","tags":["vendor-advisory","x_refsource_REDHAT","web"]},{"url":"https://access.redhat.com/errata/RHSA-2026:41951","tags":["vendor-advisory","x_refsource_REDHAT","web"]},{"url":"https://access.redhat.com/errata/RHSA-2026:62260","tags":["vendor-advisory","x_refsource_REDHAT","web"]},{"url":"https://access.redhat.com/errata/RHSA-2026:37390","tags":["vendor-advisory","x_refsource_REDHAT","web"]},{"url":"https://access.redhat.com/errata/RHSA-2026:50848","tags":["vendor-advisory","x_refsource_REDHAT","web"]},{"url":"https://access.redhat.com/errata/RHSA-2026:54435","tags":["vendor-advisory","x_refsource_REDHAT","web"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-40984","tags":["advisory"]},{"url":"https://github.com/micrometer-metrics/micrometer/commit/36da131525228188a36779a28471a76c79213dd4","tags":["web"]},{"url":"https://github.com/advisories/GHSA-g3pr-3p32-fp23"},{"url":"https://github.com/micrometer-metrics/micrometer","tags":["package"]}],"sources":{"cve":[{"id":"CVE-2026-40984","title":"Micrometer HTTP server instrumentations DoS vulnerability","description":"In Micrometer, it is possible for a user to provide specially crafted HTTP requests that may cause a denial-of-service (DoS) condition.\n\nAffected versions:\nmicrometer-core 1.16.0 through 1.16.5; 1.15.0 through 1.15.11; 1.14.0 through 1.14.15; 1.13.0 through 1.13.18; 1.9.0 through 1.9.17.\nmicrometer-jetty11 1.16.0 through 1.16.5; 1.15.0 through 1.15.11; 1.14.0 through 1.14.15; 1.13.0 through 1.13.18.\nmicrometer-jetty12 1.16.0 through 1.16.5; 1.15.0 through 1.15.11; 1.14.0 through 1.14.15; 1.13.0 through 1.13.18.","status":"published","published":"2026-06-09T03:47:46.447Z","modified":"2026-09-14T12:04:26.346Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"high","assessor":"cna"},{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"high","assessor":"adp"}],"cwes":["CWE-400","CWE-770"],"updated_at":"2026-11-02T13:43:11.445168Z"}],"euvd":[{"id":"EUVD-2026-35320","description":"In Micrometer, it is possible for a user to provide specially crafted HTTP requests that may cause a denial-of-service (DoS) condition.\n\nAffected versions:\nmicrometer-core 1.16.0 through 1.16.5; 1.15.0 through 1.15.11; 1.14.0 through 1.14.15; 1.13.0 through 1.13.18; 1.9.0 through 1.9.17.\nmicrometer-jetty11 1.16.0 through 1.16.5; 1.15.0 through 1.15.11; 1.14.0 through 1.14.15; 1.13.0 through 1.13.18.\nmicrometer-jetty12 1.16.0 through 1.16.5; 1.15.0 through 1.15.11; 1.14.0 through 1.14.15; 1.13.0 through 1.13.18.","status":"published","published":"2026-06-09T03:47:46Z","modified":"2026-09-14T12:04:26Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"high"}],"updated_at":"2026-11-02T17:28:21.2136Z"}],"ghsa":[{"id":"GHSA-g3pr-3p32-fp23","title":"Micrometer HTTP server instrumentations DoS","description":"In Micrometer, it is possible for a user to provide specially crafted HTTP requests that may cause a denial-of-service (DoS) condition.\n\nAffected versions:\nmicrometer-core 1.16.0 through 1.16.5; 1.15.0 through 1.15.11; 1.14.0 through 1.14.15; 1.13.0 through 1.13.18; 1.9.0 through 1.9.17.\nmicrometer-jetty11 1.16.0 through 1.16.5; 1.15.0 through 1.15.11; 1.14.0 through 1.14.15; 1.13.0 through 1.13.18.\nmicrometer-jetty12 1.16.0 through 1.16.5; 1.15.0 through 1.15.11; 1.14.0 through 1.14.15; 1.13.0 through 1.13.18.","status":"published","published":"2026-06-09T06:31:56Z","modified":"2026-09-11T15:32:18Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"high"}],"cwes":["CWE-400","CWE-770"],"updated_at":"2026-11-02T14:41:15.803194Z"}],"nvd":[{"id":"CVE-2026-40984","description":"In Micrometer, it is possible for a user to provide specially crafted HTTP requests that may cause a denial-of-service (DoS) condition.\n\nAffected versions:\nmicrometer-core 1.16.0 through 1.16.5; 1.15.0 through 1.15.11; 1.14.0 through 1.14.15; 1.13.0 through 1.13.18; 1.9.0 through 1.9.17.\nmicrometer-jetty11 1.16.0 through 1.16.5; 1.15.0 through 1.15.11; 1.14.0 through 1.14.15; 1.13.0 through 1.13.18.\nmicrometer-jetty12 1.16.0 through 1.16.5; 1.15.0 through 1.15.11; 1.14.0 through 1.14.15; 1.13.0 through 1.13.18.","status":"published","published":"2026-06-09T05:16:34.78Z","modified":"2026-09-14T13:18:33.703Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"high","assessor":"secondary"},{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"high","assessor":"secondary"}],"cwes":["CWE-400","CWE-770"],"updated_at":"2026-11-02T14:12:22.73178Z"}],"osv":[{"id":"GHSA-g3pr-3p32-fp23","title":"Micrometer HTTP server instrumentations DoS","description":"In Micrometer, it is possible for a user to provide specially crafted HTTP requests that may cause a denial-of-service (DoS) condition.\n\nAffected versions:\nmicrometer-core 1.16.0 through 1.16.5; 1.15.0 through 1.15.11; 1.14.0 through 1.14.15; 1.13.0 through 1.13.18; 1.9.0 through 1.9.17.\nmicrometer-jetty11 1.16.0 through 1.16.5; 1.15.0 through 1.15.11; 1.14.0 through 1.14.15; 1.13.0 through 1.13.18.\nmicrometer-jetty12 1.16.0 through 1.16.5; 1.15.0 through 1.15.11; 1.14.0 through 1.14.15; 1.13.0 through 1.13.18.","status":"published","published":"2026-06-09T06:31:56Z","modified":"2026-09-11T15:45:08.795437706Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"high"}],"cwes":["CWE-400","CWE-770"],"updated_at":"2026-11-02T15:46:47.119724Z"},{"id":"CLSA-2026-1789228075","title":"TuxCare security update for io.micrometer (1 CVE)","description":"TuxCare rebuilt 3 io.micrometer packages to address 1 CVE. Fixed in 1.13.15-tuxcare.1.","status":"published","published":"2026-09-12T15:47:55Z","modified":"2026-11-02T19:46:15.173058714Z","updated_at":"2026-11-02T20:29:33.792105Z"},{"id":"CLSA-2026-1791901525","title":"TuxCare security update for io.micrometer:micrometer-core (3 CVEs)","description":"TuxCare rebuilt io.micrometer:micrometer-core to address 3 CVEs. Fixed in 1.12.13-tuxcare.1.","status":"published","published":"2026-10-13T14:25:25Z","modified":"2026-11-02T19:46:27.203735841Z","updated_at":"2026-11-02T20:29:13.152182Z"},{"id":"CLSA-2026-1792000121","title":"TuxCare security update for io.micrometer (3 CVEs)","description":"TuxCare rebuilt 3 io.micrometer packages to address 3 CVEs. Fixed in 1.12.12-tuxcare.1.","status":"published","published":"2026-10-14T17:48:41Z","modified":"2026-11-02T19:46:27.951184978Z","updated_at":"2026-11-02T20:29:13.152182Z"},{"id":"ROOT-APP-MAVEN-CVE-2026-40984","title":"CVE-2026-40984 in io.micrometer:micrometer-core - Patched by Root","description":"Root has patched CVE-2026-40984 in the io.micrometer:micrometer-core package for Root:Maven. Multiple fixed versions available.","status":"published","published":"2026-11-03T10:31:20Z","modified":"2026-11-03T11:15:10.834654173Z","updated_at":"2026-11-03T11:30:16.221977Z"}]}}