Loading vulnerability…
Denial of Service in Micrometer HTTP Server Instrumentation
CVE-2026-40984 is an uncontrolled resource consumption vulnerability in Micrometer HTTP server instrumentation. Specially crafted HTTP requests can cause denial of service when affected instrumentation is configured and recording metrics. Affected micrometer-core versions are 1.16.0–1.16.5, 1.15.0–1.15.11, 1.14.0–1.14.15, 1.13.0–1.13.18, and 1.9.0–1.9.17. Affected micrometer-jetty11 and micrometer-jetty12 versions are 1.16.0–1.16.5, 1.15.0–1.15.11, 1.14.0–1.14.15, and 1.13.0–1.13.18. Unsupported releases may also be affected. Exploitation is remotely accessible without authentication or user interaction. The specific vulnerable function and request characteristics are not established.
What it means and what to do now: patch path, interim mitigations, and the assume-compromise checklist.
What an attacker gets, and what they’ve been doing with it.
Successful exploitation can exhaust server resources and disrupt the availability of applications using affected Micrometer HTTP instrumentation, preventing legitimate HTTP requests from being served. The vulnerability is rated High with a CVSS v3.1 score of 7.5 (AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H). Its assessed impact is limited to availability; confidentiality and integrity compromise are not identified.
If you can’t patch tonight, do this now.
Until patched, restrict untrusted access to affected HTTP endpoints where feasible. Apply request-size, header-size, rate, and connection limits at the reverse proxy or application server, and monitor for anomalous requests and resource consumption. These measures may reduce exposure but are not established as complete protection against the crafted-request trigger. Upgrading remains the definitive remediation.
Patch, then assume compromise.
Upgrade affected Micrometer components to the fixed release for their branch: 1.16.6 or 1.15.12 for open-source releases; 1.14.16, 1.13.19, or 1.9.18 under enterprise support, as applicable. Update all affected Micrometer artifacts, including dependencies bundled by application frameworks or vendor products. Do not assume every version numerically later than 1.15.12 is fixed: versions 1.16.0–1.16.5 remain affected. No additional configuration changes are required after upgrading.
No public exploits tracked yet. Mallory keeps watching.
25 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.