open-source-dependency-vulnerabilitywidely-deployed-product-advisoryinternet-facing-service-vulnerability

Micrometer HTTP and gRPC Instrumentation Flaws Enable Denial-of-Service

Vulnerability Disclosure · 3 sources · Updated 4mo ago · First seen Jun 8, 2026

Spring disclosed two high-severity denial-of-service vulnerabilities in Micrometer server instrumentation: CVE-2026-40984 affecting HTTP server instrumentations and CVE-2026-40983 affecting gRPC server instrumentation. The HTTP issue can be triggered by specially crafted HTTP requests in applications using vulnerable versions of micrometer-core, micrometer-jetty11, or micrometer-jetty12 with HTTP server instrumentation and metrics recording enabled. The gRPC issue can be triggered by specially crafted gRPC requests when applications use vulnerable io.micrometer:micrometer-core releases together with ObservationRegistry, metric-producing observation handlers, and ObservationGrpcServerInterceptor.

Affected versions include Micrometer 1.16.0 through 1.16.5 and 1.15.0 through 1.15.11, with the HTTP flaw also spanning additional older supported and unsupported release lines. Spring released fixes for open-source users in Micrometer 1.16.6 and 1.15.12, while enterprise-supported fixes for the HTTP issue are available in 1.14.16, 1.13.19, and 1.9.18. The vulnerabilities were responsibly reported by Yu Bao of PayPal, and the Canadian Centre for Cyber Security urged administrators to review Spring’s advisories and apply the necessary updates.

Do you run this?See affected versions and whether adversaries are exploiting it.

Check your exposure

Event timeline

How this story unfolded

Events from the most recent confirmed update back to the earliest known activity.

4 events · Jun 8, 2026

Jun 8, 20265mo ago
Canadian Centre for Cyber Security issues advisory AV26-558
On 2026-06-08, the Canadian Centre for Cyber Security published advisory AV26-558 highlighting Spring's Micrometer-related vulnerabilities CVE-2026-40983 and CVE-2026-40984. The notice urged users and administrators to review the linked advisories and apply the necessary updates.
Spring security advisory (AV26-558) - Canadian Centre for Cyber Security
Jun 8, 20265mo ago
Micrometer fixes released for affected OSS and enterprise versions
Spring advised users to upgrade to Micrometer 1.16.6 or 1.15.12 to remediate the disclosed vulnerabilities. For CVE-2026-40984, enterprise-supported fixes were also made available in versions 1.14.16, 1.13.19, and 1.9.18.
CVE-2026-40983: Micrometer gRPC server instrumentation DoS vulnerability
Jun 8, 20265mo ago
Spring publishes advisories for CVE-2026-40983 and CVE-2026-40984
On 2026-06-08, Spring published security advisories for two high-severity denial-of-service flaws in Micrometer: CVE-2026-40983 affecting gRPC server instrumentation and CVE-2026-40984 affecting HTTP server instrumentations. The advisories identified affected versions and described the conditions required to trigger the DoS issues.
CVE-2026-40983: Micrometer gRPC server instrumentation DoS vulnerability
Jun 8, 20265mo ago
Yu Bao of PayPal responsibly reports Micrometer DoS vulnerabilities
Spring's advisories state that the Micrometer denial-of-service vulnerabilities were responsibly reported by Yu Bao of PayPal. The references do not provide a specific date for when the report was made.
CVE-2026-40983: Micrometer gRPC server instrumentation DoS vulnerability

Linked entities

Related entities

Vulnerabilities, threat actors, malware, products, organizations, and breaches Mallory has linked to this story.

Open in app →

Vulnerabilities

2 linked

Denial of Service in Micrometer HTTP Server Instrumentation (CVE-2026-40984)Denial of Service in Micrometer gRPC Server Instrumentation (CVE-2026-40983)

Do you run this?See whether adversaries are exploiting this yet, and where the affected versions run in your environment.

Check Your Exposure

Source coverage

Sources

3 references tracked. Mallory keeps watching after this page renders.

Ca CcsNews · Jun 8, 2026

Spring security advisory (AV26-558) - Canadian Centre for Cyber SecurityOpen source ↗

SpringNews · Jun 8, 2026

CVE-2026-40983: Micrometer gRPC server instrumentation DoS vulnerabilityOpen source ↗

SpringNews · Jun 8, 2026

CVE-2026-40984: Micrometer HTTP server instrumentations DoS vulnerabilityOpen source ↗

Mallory platform

See the full picture, correlated to your attack surface.

This page covers what’s public. Mallory adds the parts that aren’t: which of your assets are affected, which threat actors are using it right now, and what to deploy next.

Start Free Trial Open in App

Exposure mappingMap indicators from this story to your assets and identify affected systems in minutes.

Threat actor evidenceEvery observed campaign, victim, and pivot linked to actors named in this story.

Associated malwareMalware, exploits, and IOCs connected to the activity described here.

Detection signaturesYARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.

Scheduled alertsGet matching new stories delivered to your team as they break, not the next morning.

AI threadsAsk questions about this story and take action on the answers.

Micrometer HTTP and gRPC Instrumentation Flaws Enable Denial-of-Service

How this story unfolded

Canadian Centre for Cyber Security issues advisory AV26-558

Micrometer fixes released for affected OSS and enterprise versions

Spring publishes advisories for CVE-2026-40983 and CVE-2026-40984

Yu Bao of PayPal responsibly reports Micrometer DoS vulnerabilities

Related entities

Vulnerabilities

Sources

See the full picture, correlated to your attack surface.

Related stories

DoS Flaws in Micronaut and Netty Let Remote Attackers Exhaust Server Resources

Spring discloses Spring AI injection flaw and Spring gRPC security context issues

Spring patches LDAP auth bypass and multiple DoS flaws across Framework and Data

Micrometer HTTP and gRPC Instrumentation Flaws Enable Denial-of-Service

How this story unfolded

Canadian Centre for Cyber Security issues advisory AV26-558

Micrometer fixes released for affected OSS and enterprise versions

Spring publishes advisories for CVE-2026-40983 and CVE-2026-40984

Yu Bao of PayPal responsibly reports Micrometer DoS vulnerabilities

Related entities

Vulnerabilities

Sources

See the full picture, correlated to your attack surface.

Related stories

DoS Flaws in Micronaut and Netty Let Remote Attackers Exhaust Server Resources

Spring discloses Spring AI injection flaw and Spring gRPC security context issues

Spring patches LDAP auth bypass and multiple DoS flaws across Framework and Data