Loading story…
Spring disclosed two high-severity denial-of-service vulnerabilities in Micrometer server instrumentation: CVE-2026-40984 affecting HTTP server instrumentations and CVE-2026-40983 affecting gRPC server instrumentation. The HTTP issue can be triggered by specially crafted HTTP requests in applications using vulnerable versions of micrometer-core, micrometer-jetty11, or micrometer-jetty12 with HTTP server instrumentation and metrics recording enabled. The gRPC issue can be triggered by specially crafted gRPC requests when applications use vulnerable io.micrometer:micrometer-core releases together with ObservationRegistry, metric-producing observation handlers, and ObservationGrpcServerInterceptor.
Affected versions include Micrometer 1.16.0 through 1.16.5 and 1.15.0 through 1.15.11, with the HTTP flaw also spanning additional older supported and unsupported release lines. Spring released fixes for open-source users in Micrometer 1.16.6 and 1.15.12, while enterprise-supported fixes for the HTTP issue are available in 1.14.16, 1.13.19, and 1.9.18. The vulnerabilities were responsibly reported by Yu Bao of PayPal, and the Canadian Centre for Cyber Security urged administrators to review Spring’s advisories and apply the necessary updates.
Mallory correlates global threat intelligence with your attack surface — know if you’re exposed before adversaries strike.
4 events from the most recent confirmed update back to the earliest known activity.
On 2026-06-08, the Canadian Centre for Cyber Security published advisory AV26-558 highlighting Spring's Micrometer-related vulnerabilities CVE-2026-40983 and CVE-2026-40984. The notice urged users and administrators to review the linked advisories and apply the necessary updates.
Spring advised users to upgrade to Micrometer 1.16.6 or 1.15.12 to remediate the disclosed vulnerabilities. For CVE-2026-40984, enterprise-supported fixes were also made available in versions 1.14.16, 1.13.19, and 1.9.18.
On 2026-06-08, Spring published security advisories for two high-severity denial-of-service flaws in Micrometer: CVE-2026-40983 affecting gRPC server instrumentation and CVE-2026-40984 affecting HTTP server instrumentations. The advisories identified affected versions and described the conditions required to trigger the DoS issues.
Spring's advisories state that the Micrometer denial-of-service vulnerabilities were responsibly reported by Yu Bao of PayPal. The references do not provide a specific date for when the report was made.
Vulnerabilities, threat actors, malware, products, organizations, and breaches Mallory has linked to this story.
3 references tracked. Mallory keeps watching after this page renders.
cyber.gc.ca
Open sourcespring.io
Open sourcespring.io
Open sourceMap indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
Two high-severity denial-of-service vulnerabilities were disclosed in widely used Java infrastructure components, allowing remote attackers to exhaust CPU and memory and disrupt application availability without authentication. In Micronaut, `CVE-2026-33013` affects versions before `4.10.16` and `3.10.5` and is caused by improper handling of descending array indices during `application/x-www-form-urlencoded` body binding in `JsonBeanPropertyBinder::expandArrayToThreshold`. A crafted request using indexed parameters such as `authors[1].name` followed by `authors[0].name` can trigger a non-terminating loop, CPU exhaustion, and an `OutOfMemoryError`. Netty separately patched `CVE-2026-33871`, a denial-of-service flaw in HTTP/2 processing that affects versions before `4.1.132.Final` and `4.2.10.Final`. The bug lets attackers flood servers with `CONTINUATION` frames because the framework did not enforce a limit on their number, and existing size-based protections could be bypassed with zero-byte frames. The result is excessive CPU consumption with minimal bandwidth, potentially leaving HTTP/2 services unresponsive. The issues are tracked as `CWE-835` in Micronaut and `CWE-770` in Netty, and both vendors released fixed versions for affected branches.
Jun 29, 2026
Spring published three security advisories covering **Spring AI** and **Spring gRPC**, including `CVE-2026-40967`, a flaw in VectorStore `FilterExpressionConverter` implementations that can let attackers manipulate generated vector store queries because keys and values are not properly escaped. The issue affects Spring AI versions `1.0.0` through `1.0.5` and `1.1.0` through `1.1.4`, and is fixed in `1.0.6` and `1.1.5`. External vulnerability tracking describes the bug as a high-severity code or query injection risk with CVSS `AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:L/A:L` and maps it to `CWE-94`. Spring also disclosed two **Spring gRPC** vulnerabilities: `CVE-2026-40968`, in which `SecurityContext` data can leak across requests after an authorization failure, and `CVE-2026-40969`, where an `AuthenticationException` message may be reflected back to a remote client. Together, the advisories point to risks of query manipulation, cross-request security context exposure, and unintended error-message disclosure in applications built on affected Spring components.
Jun 29, 2026
Spring disclosed a broad set of vulnerabilities across **Spring Framework**, **Spring Data Commons**, and **Spring LDAP**, including a high-severity authentication bypass tracked as `CVE-2026-41720`. The LDAP flaw allows login with a valid username and an empty or null password when the backing LDAP server permits unauthenticated binds, affecting authentication flows that use `AbstractContextSource`, `LdapTemplate`, or `LdapClient`. Spring also fixed a low-severity WebFlux session fixation issue (`CVE-2026-41839`) tied to compromised subdomains, and an information disclosure bug (`CVE-2026-41841`) in Spring MVC and WebFlux where shared static-resource caches could expose protected files if a public resource with the same name had already been cached. Several denial-of-service issues were patched at the same time. In Spring Framework, `CVE-2026-41840` can leak memory through malicious multipart requests in WebFlux, while `CVE-2026-41842` can tie up HTTP connections through slow resolution of versioned file-system resources in Spring MVC or WebFlux. In Spring Data Commons, `CVE-2026-41695`, `CVE-2026-41711`, `CVE-2026-41716`, and `CVE-2026-41721` can be triggered by attacker-controlled property paths, sort parameters, property names, or `@ProjectedPayload` data binding, leading to stack overflows, heap exhaustion, or excessive memory allocation when applications expose those inputs to untrusted users. Spring urged customers to upgrade to fixed releases, including Framework `7.0.8`, `6.2.19`, and `6.1.28`, Data Commons `4.0.6` and `3.5.12`, and LDAP `2.4.5`, `3.2.18`, `3.3.8`, or `4.0.4`, with some older branches receiving fixes only through commercial support.
Jun 29, 2026