{"id":"CVE-2026-59295","aliases":["CLSA-2026-1791901251","CLSA-2026-1791901525","CLSA-2026-1791911066","CLSA-2026-1791911955","CLSA-2026-1791912256","CLSA-2026-1792000121","CLSA-2026-1793119973","EUVD-2026-64774","GHSA-v7hr-hgg3-vv6q"],"status":"published","title":"Micrometer instrumentation of Apache HttpAsyncClient DoS vulnerability","description":"It is possible for outbound HTTP requests using a Micrometer-instrumented client to cause a denial-of-service (DoS) condition due to an unbounded memory leak.\nMicrometer 1.17.0\nMicrometer 1.16.0 - 1.16.6\nMicrometer 1.15.0 - 1.15.12\nMicrometer 1.14.0 - 1.14.16\nMicrometer 1.9.18 and earlier","severity":{"version":"3.1","score":5.9,"vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"medium","assessor":"cna","from":"cve"},"epss":{"day":"2026-11-12","score":0.00367,"percentile":0.30941,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":false,"fix_available":false},"cwes":["CWE-401"],"published":"2026-08-24T10:10:06Z","modified":"2026-11-02T19:46:32Z","affected":[{"source":"osv","ecosystem":"TuxCare:Maven","package":"io.micrometer:micrometer-core","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"1.13.15"},{"fixed":"1.13.15-tuxcare.3"}]}],"versions":["1.13.15","1.13.15-tuxcare.1","1.13.15-tuxcare.2"],"bundled":2},{"source":"osv","ecosystem":"TuxCare:Maven","package":"io.micrometer:micrometer-registry-statsd","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"1.13.15"},{"fixed":"1.13.15-tuxcare.3"}]}],"versions":["1.13.15","1.13.15-tuxcare.1","1.13.15-tuxcare.2"],"bundled":2},{"source":"osv","ecosystem":"TuxCare:Maven","package":"io.micrometer:micrometer-core","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"1.12.13"},{"fixed":"1.12.13-tuxcare.1"}]}],"versions":["1.12.13"],"bundled":3},{"source":"osv","ecosystem":"TuxCare:Maven","package":"io.micrometer:micrometer-core","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"1.15.12"},{"fixed":"1.15.12-tuxcare.1"}]}],"versions":["1.15.12"],"bundled":2},{"source":"osv","ecosystem":"TuxCare:Maven","package":"io.micrometer:micrometer-registry-statsd","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"1.15.12"},{"fixed":"1.15.12-tuxcare.1"}]}],"versions":["1.15.12"],"bundled":2},{"source":"osv","ecosystem":"TuxCare:Maven","package":"io.micrometer:micrometer-core","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"1.14.14"},{"fixed":"1.14.14-tuxcare.1"}]}],"versions":["1.14.14"],"bundled":2},{"source":"osv","ecosystem":"TuxCare:Maven","package":"io.micrometer:micrometer-registry-statsd","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"1.14.14"},{"fixed":"1.14.14-tuxcare.1"}]}],"versions":["1.14.14"],"bundled":2},{"source":"osv","ecosystem":"TuxCare:Maven","package":"io.micrometer:micrometer-core","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"1.9.17"},{"fixed":"1.9.17-tuxcare.1"}]}],"versions":["1.9.17"],"bundled":2},{"source":"osv","ecosystem":"TuxCare:Maven","package":"io.micrometer:micrometer-registry-statsd","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"1.9.17"},{"fixed":"1.9.17-tuxcare.1"}]}],"versions":["1.9.17"],"bundled":2},{"source":"osv","ecosystem":"TuxCare:Maven","package":"io.micrometer:micrometer-core","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"1.12.12"},{"fixed":"1.12.12-tuxcare.1"}]}],"versions":["1.12.12"],"bundled":3},{"source":"osv","ecosystem":"TuxCare:Maven","package":"io.micrometer:micrometer-jetty11","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"1.12.12"},{"fixed":"1.12.12-tuxcare.1"}]}],"versions":["1.12.12"],"bundled":3},{"source":"osv","ecosystem":"TuxCare:Maven","package":"io.micrometer:micrometer-registry-statsd","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"1.12.12"},{"fixed":"1.12.12-tuxcare.1"}]}],"versions":["1.12.12"],"bundled":3},{"source":"osv","ecosystem":"TuxCare:Maven","package":"io.micrometer:micrometer-core","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"1.11.8"},{"fixed":"1.11.8-tuxcare.1"}]}],"versions":["1.11.8"],"bundled":2},{"source":"osv","ecosystem":"TuxCare:Maven","package":"io.micrometer:micrometer-registry-statsd","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"1.11.8"},{"fixed":"1.11.8-tuxcare.1"}]}],"versions":["1.11.8"],"bundled":2}],"products":[{"vendor":"spring","product":"micrometer"}],"references":[{"url":"https://spring.io/security/cve-2026-59295"},{"url":"https://github.com/spring-projects/security-advisories/security/advisories/GHSA-747c-jhq3-w433"},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-59295"},{"url":"https://github.com/advisories/GHSA-v7hr-hgg3-vv6q"}],"sources":{"cve":[{"id":"CVE-2026-59295","title":"Micrometer instrumentation of Apache HttpAsyncClient DoS vulnerability","description":"It is possible for outbound HTTP requests using a Micrometer-instrumented client to cause a denial-of-service (DoS) condition due to an unbounded memory leak.\nMicrometer 1.17.0\nMicrometer 1.16.0 - 1.16.6\nMicrometer 1.15.0 - 1.15.12\nMicrometer 1.14.0 - 1.14.16\nMicrometer 1.9.18 and earlier","status":"published","published":"2026-08-24T10:10:06.302Z","modified":"2026-08-27T17:57:52.554Z","cvss":[{"version":"3.1","score":5.9,"vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"medium","assessor":"cna"}],"updated_at":"2026-11-02T14:19:58.560602Z"}],"euvd":[{"id":"EUVD-2026-64774","description":"It is possible for outbound HTTP requests using a Micrometer-instrumented client to cause a denial-of-service (DoS) condition due to an unbounded memory leak.\nMicrometer 1.17.0\nMicrometer 1.16.0 - 1.16.6\nMicrometer 1.15.0 - 1.15.12\nMicrometer 1.14.0 - 1.14.16\nMicrometer 1.9.18 and earlier","status":"published","published":"2026-08-24T10:10:06Z","modified":"2026-08-27T17:57:52Z","cvss":[{"version":"3.1","score":5.9,"vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"medium"}],"updated_at":"2026-11-02T18:01:26.820985Z"}],"ghsa":[{"id":"GHSA-v7hr-hgg3-vv6q","title":"Micrometer-instrumented Apache HttpAsyncClient (4.x or 5.x) usage via...","description":"Micrometer-instrumented Apache HttpAsyncClient (4.x or 5.x) usage via MicrometerHttpClientInterceptor can leak memory unboundedly when asynchronous requests fail before receiving a response (e.g. connection resets or timeouts). Tracking state for these requests remains in memory indefinitely, and sustained failures lead to heap exhaustion and OutOfMemoryError crashes.","status":"published","published":"2026-08-24T12:31:38Z","modified":"2026-08-24T12:31:46Z","cvss":[{"version":"3.1","score":5.9,"vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"medium"}],"cwes":["CWE-401"],"updated_at":"2026-11-02T15:10:52.810585Z"}],"nvd":[{"id":"CVE-2026-59295","description":"It is possible for outbound HTTP requests using a Micrometer-instrumented client to cause a denial-of-service (DoS) condition due to an unbounded memory leak.\nMicrometer 1.17.0\nMicrometer 1.16.0 - 1.16.6\nMicrometer 1.15.0 - 1.15.12\nMicrometer 1.14.0 - 1.14.16\nMicrometer 1.9.18 and earlier","status":"published","published":"2026-08-24T11:16:39.78Z","modified":"2026-10-12T15:10:00.207Z","cvss":[{"version":"3.1","score":5.9,"vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"medium","assessor":"secondary"}],"updated_at":"2026-11-02T14:12:41.018848Z"}],"osv":[{"id":"CLSA-2026-1791901251","title":"TuxCare security update for io.micrometer (2 CVEs)","description":"TuxCare rebuilt 2 io.micrometer packages to address 2 CVEs. Fixed in 1.13.15-tuxcare.3.","status":"published","published":"2026-10-13T14:20:51Z","modified":"2026-11-02T19:46:27.740380039Z","updated_at":"2026-11-02T20:29:13.152182Z"},{"id":"CLSA-2026-1791901525","title":"TuxCare security update for io.micrometer:micrometer-core (3 CVEs)","description":"TuxCare rebuilt io.micrometer:micrometer-core to address 3 CVEs. Fixed in 1.12.13-tuxcare.1.","status":"published","published":"2026-10-13T14:25:25Z","modified":"2026-11-02T19:46:27.203735841Z","updated_at":"2026-11-02T20:29:13.152182Z"},{"id":"CLSA-2026-1791911066","title":"TuxCare security update for io.micrometer (2 CVEs)","description":"TuxCare rebuilt 2 io.micrometer packages to address 2 CVEs. Fixed in 1.15.12-tuxcare.1.","status":"published","published":"2026-10-13T17:04:26Z","modified":"2026-11-02T19:46:27.366809828Z","updated_at":"2026-11-02T20:29:13.152182Z"},{"id":"CLSA-2026-1791911955","title":"TuxCare security update for io.micrometer (2 CVEs)","description":"TuxCare rebuilt 2 io.micrometer packages to address 2 CVEs. Fixed in 1.14.14-tuxcare.1.","status":"published","published":"2026-10-13T17:19:15Z","modified":"2026-11-02T19:46:27.282557624Z","updated_at":"2026-11-02T20:29:13.152182Z"},{"id":"CLSA-2026-1791912256","title":"TuxCare security update for io.micrometer (2 CVEs)","description":"TuxCare rebuilt 2 io.micrometer packages to address 2 CVEs. Fixed in 1.9.17-tuxcare.1.","status":"published","published":"2026-10-13T17:24:16Z","modified":"2026-11-02T19:46:27.275042672Z","updated_at":"2026-11-02T20:29:13.152182Z"},{"id":"CLSA-2026-1792000121","title":"TuxCare security update for io.micrometer (3 CVEs)","description":"TuxCare rebuilt 3 io.micrometer packages to address 3 CVEs. Fixed in 1.12.12-tuxcare.1.","status":"published","published":"2026-10-14T17:48:41Z","modified":"2026-11-02T19:46:27.951184978Z","updated_at":"2026-11-02T20:29:13.152182Z"},{"id":"CLSA-2026-1793119973","title":"TuxCare security update for io.micrometer (2 CVEs)","description":"TuxCare rebuilt 2 io.micrometer packages to address 2 CVEs. Fixed in 1.11.8-tuxcare.1.","status":"published","published":"2026-10-27T16:52:53Z","modified":"2026-11-02T19:46:32.127233376Z","updated_at":"2026-11-02T20:28:59.01272Z"}]}}