Loading vulnerability…
Denial of Service in Micrometer gRPC Server Instrumentation
CVE-2026-40983 is an uncontrolled resource consumption vulnerability in Micrometer's gRPC server instrumentation in micrometer-core. Specially crafted gRPC requests can cause denial of service when ObservationGrpcServerInterceptor instruments the server, an ObservationRegistry records observations, and DefaultMeterObservationHandler or an equivalent custom handler produces metrics from those observations. Affected versions are 1.16.0 through 1.16.5 and 1.15.0 through 1.15.11. Versions earlier than 1.15.0 are not affected. The precise request characteristics and internal resource-exhaustion mechanism are not publicly specified in the available vulnerability details.
What it means and what to do now: patch path, interim mitigations, and the assume-compromise checklist.
What an attacker gets, and what they’ve been doing with it.
Successful exploitation can disrupt the availability of an affected application through denial of service. The vulnerability is rated High with a CVSS v3.1 score of 7.5 and vector AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H. No direct confidentiality or integrity impact is identified.
If you can’t patch tonight, do this now.
No separate workaround is specified. Upgrading to a fixed version is the recommended corrective action, with no additional mitigation steps required afterward.
Patch, then assume compromise.
Upgrade micrometer-core to version 1.16.6 or a later fixed release in the 1.16.x line, or version 1.15.12 or a later fixed release in the 1.15.x line. Both fixes are available as open-source releases. For products bundling Micrometer, apply the vendor update that incorporates the fix.
No public exploits tracked yet. Mallory keeps watching.
18 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.