ai.agentican:agentican-quarkus-metrics (>=0.1.0-alpha.1, <=0.1.0-alpha.4), ai.pipestream.module:module-chunker (0.1.3) +3190 more potentially affected by CVE-2026-40983 via io.micrometer:micrometer-core (>=1.16.0, <=1.16.5)

io.micrometer:micrometer-core MAVEN version =1.16.0, =0.1.0-alpha.1, =0.7.20, =0.7.20, =0.7.20, =0.1.31, =0.7.20, =0.7.20, =4.13.5, =4.5.0, =4.5.0, =4.5.0, =4.6.0 and more Source cves: CVE-2026-40983 Source advisory: OSV:GHSA-W737-WX49-QJ23...

ai.koog:koog-spring-ai-starter-chat-memory (>=0.8.0-rc-1, <=1.3.0-beta), ai.koog:koog-spring-ai-starter-model-chat (>=0.7.0, <=1.3.0-beta) +3705 more potentially affected by CVE-2026-40983 via io.micrometer:micrometer-core (>=1.15.0, <=1.15.11)

io.micrometer:micrometer-core MAVEN version =1.15.0, =0.8.0-rc-1, =0.7.0, =0.7.0, =0.8.0-rc-1, =1.0.0, =1.0.0, =1.23.0, =1.23.0, =1.23.0, =0.6.0, =1.6.0, =1.5.4, =1.0.0, =0.9.0, =1.0.1 and more Source cves: CVE-2026-40983 Source advisory: OSV:GHSA-W737-WX49-QJ23...

ai.koog:koog-spring-ai-starter-chat-memory (>=0.8.0-rc-1, <=1.3.0-beta), ai.koog:koog-spring-ai-starter-model-chat (>=0.7.0, <=1.3.0-beta) +3705 more potentially affected by CVE-2026-40983 via io.micrometer:micrometer-core (>=1.15.0, <=1.15.11)

io.micrometer:micrometer-core MAVEN version =1.15.0, =0.8.0-rc-1, =0.7.0, =0.7.0, =0.8.0-rc-1, =1.0.0, =1.0.0, =1.23.0, =1.23.0, =1.23.0, =0.6.0, =1.6.0, =1.5.4, =1.0.0, =0.9.0, =1.0.1 and more Source cves: CVE-2026-40983 Source advisory: GHSA-W737-WX49-QJ23...

GHSA-G3PR-3P32-FP23 Micrometer HTTP server instrumentations DoS

In Micrometer, it is possible for a user to provide specially crafted HTTP requests that may cause a denial-of-service DoS condition. Affected versions: micrometer-core 1.16.0 through 1.16.5; 1.15.0 through 1.15.11; 1.14.0 through 1.14.15; 1.13.0 through 1.13.18; 1.9.0 through 1.9.17...

Micrometer HTTP server instrumentations DoS

In Micrometer, it is possible for a user to provide specially crafted HTTP requests that may cause a denial-of-service DoS condition. Affected versions: micrometer-core 1.16.0 through 1.16.5; 1.15.0 through 1.15.11; 1.14.0 through 1.14.15; 1.13.0 through 1.13.18; 1.9.0 through 1.9.17...

ai.koog:koog-spring-ai-starter-chat-memory (>=0.8.0-rc-1, <=1.3.0-beta), ai.koog:koog-spring-ai-starter-model-chat (>=0.7.0, <=1.3.0-beta) +3705 more potentially affected by CVE-2026-40984 via io.micrometer:micrometer-core (>=1.15.0, <=1.15.11)

io.micrometer:micrometer-core MAVEN version =1.15.0, =0.8.0-rc-1, =0.7.0, =0.7.0, =0.8.0-rc-1, =1.0.0, =1.0.0, =1.23.0, =1.23.0, =1.23.0, =0.6.0, =1.6.0, =1.5.4, =1.0.0, =0.9.0, =1.0.1 and more Source cves: CVE-2026-40984 Source advisory: GHSA-G3PR-3P32-FP23...

io.javalin:javalin-bundle (>=6.6.0, <=6.7.0), io.javalin:javalin-micrometer (>=6.6.0, <=6.7.0) +1 more potentially affected by CVE-2026-40984 via io.micrometer:micrometer-jetty11 (>=1.14.2, <=1.14.5)

io.micrometer:micrometer-jetty11 MAVEN version =1.14.2, =6.6.0, =6.6.0, =6.7.0 - org.apache.zeppelin:zeppelin-server 0.12.1 Source cves: CVE-2026-40984 Source advisory: GHSA-G3PR-3P32-FP23...

ai.koog:koog-spring-ai-starter-chat-memory (>=0.8.0-rc-1, <=1.3.0-beta), ai.koog:koog-spring-ai-starter-model-chat (>=0.7.0, <=1.3.0-beta) +3705 more potentially affected by CVE-2026-40984 via io.micrometer:micrometer-core (>=1.15.0, <=1.15.11)

io.micrometer:micrometer-core MAVEN version =1.15.0, =0.8.0-rc-1, =0.7.0, =0.7.0, =0.8.0-rc-1, =1.0.0, =1.0.0, =1.23.0, =1.23.0, =1.23.0, =0.6.0, =1.6.0, =1.5.4, =1.0.0, =0.9.0, =1.0.1 and more Source cves: CVE-2026-40984 Source advisory: OSV:GHSA-G3PR-3P32-FP23...

io.javalin:javalin-bundle (>=5.2.0, <=6.5.0), io.javalin:javalin-micrometer (>=5.2.0, <=6.5.0) +1 more potentially affected by CVE-2026-40984 via io.micrometer:micrometer-jetty11 (>=1.10.1, <=1.13.4)

io.micrometer:micrometer-jetty11 MAVEN version =1.10.1, =5.2.0, =5.2.0, =0.13.1, =0.14.0 Source cves: CVE-2026-40984 Source advisory: GHSA-G3PR-3P32-FP23...

ai.aletyx.kogito:aletyx-kogito-ai-addons-springboot-adhoc-subprocess (>=0.1.0, <=0.2.0), ai.aletyx.kogito:aletyx-kogito-ai-addons-springboot-adhoc-subprocess-storage-jpa (>=0.1.0, <=0.2.0) +3513 more potentially affected by CVE-2026-40984 via io.micrometer:micrometer-core (>=1.14.0, <=1.14.14)

io.micrometer:micrometer-core MAVEN version =1.14.0, =0.1.0, =0.1.0, =0.5.0, =0.8.0, =1.0.0, =1.0.0, =1.0.0, =1.0.0, =1.0.29 and more Source cves: CVE-2026-40984 Source advisory: GHSA-G3PR-3P32-FP23...

ai.aletyx.kogito:aletyx-kogito-ai-addons-springboot-adhoc-subprocess (>=0.1.0, <=0.2.0), ai.aletyx.kogito:aletyx-kogito-ai-addons-springboot-adhoc-subprocess-storage-jpa (>=0.1.0, <=0.2.0) +3513 more potentially affected by CVE-2026-40984 via io.micrometer:micrometer-core (>=1.14.0, <=1.14.14)

io.micrometer:micrometer-core MAVEN version =1.14.0, =0.1.0, =0.1.0, =0.5.0, =0.8.0, =1.0.0, =1.0.0, =1.0.0, =1.0.0, =1.0.29 and more Source cves: CVE-2026-40984 Source advisory: OSV:GHSA-G3PR-3P32-FP23...

ai.ancf.lmos-router:lmos-router-hybrid-spring-boot-starter (0.28.0), ai.ancf.lmos-router:lmos-router-llm-spring-boot-starter (0.28.0) +7428 more potentially affected by CVE-2026-40984 via io.micrometer:micrometer-core (>=1.10.0, <=1.13.15)

io.micrometer:micrometer-core MAVEN version =1.10.0, =0.1.1, =0.0.4, =0.1.0, =def544ccef5f753238ecc4adfc2eaa7d2fc36d53-0.0.91, =def544ccef5f753238ecc4adfc2eaa7d2fc36d53-0.0.91, =def544ccef5f753238ecc4adfc2eaa7d2fc36d53-0.0.91, =0.6.0, =0.6.0, =0.6.0, =0.6.0, =0.6.0, =0.7.0, =0.9.2 and more Source...

io.micrometer:micrometer-registry-atlas (0.12.0.release), io.micrometer:micrometer-registry-datadog (0.12.0.release) +6 more potentially affected by CVE-2026-40984 via io.micrometer:micrometer-core (0.12.0.release)

io.micrometer:micrometer-core MAVEN version 0.12.0.release is affected by a known vulnerability. The following packages have a transitive dependency on io.micrometer:micrometer-core and may be impacted: - io.micrometer:micrometer-registry-atlas 0.12.0.release -...

ai.foremast.metrics:foremast-spring-4x-k8s-metrics (>=0.1.6, <=0.2.0), ai.foremast.metrics:foremast-spring-boot-15x-starter (>=0.1.8, <=0.1.12) +10837 more potentially affected by CVE-2026-40984 via io.micrometer:micrometer-core (>=1.0.0-rc.1, <=1.9.17)

io.micrometer:micrometer-core MAVEN version =1.0.0-rc.1, =0.1.6, =0.1.8, =0.1.6, =0.1.2, =0.5.0, =0.5.0, =0.5.0, =0.5.0, =0.5.0, =0.5.0, =0.5.0, =0.0.2, =0.0.2, =0.0.2, =0.0.2, =0.3.0 and more Source cves: CVE-2026-40984 Source advisory: OSV:GHSA-G3PR-3P32-FP23...

io.javalin:javalin-micrometer (7.0.0-alpha.3) potentially affected by CVE-2026-40984 via io.micrometer:micrometer-jetty12 (1.14.2)

io.micrometer:micrometer-jetty12 MAVEN version 1.14.2 is affected by a known vulnerability. The following packages have a transitive dependency on io.micrometer:micrometer-jetty12 and may be impacted: - io.javalin:javalin-micrometer 7.0.0-alpha.3 Source cves: CVE-2026-40984 Source advisory:...

io.javalin:javalin-micrometer (>=7.0.0-alpha.4, <=7.2.2), io.jexxa.jlegmed:jlegmed-metrics (>=5.5.0, <=5.5.1) +1 more potentially affected by CVE-2026-40984 via io.micrometer:micrometer-jetty12 (>=1.16.1, <=1.16.5)

io.micrometer:micrometer-jetty12 MAVEN version =1.16.1, =7.0.0-alpha.4, =5.5.0, =1.0.3, =2.0.0 Source cves: CVE-2026-40984 Source advisory: GHSA-G3PR-3P32-FP23...

io.javalin:javalin-micrometer (7.0.0-alpha.3) potentially affected by CVE-2026-40984 via io.micrometer:micrometer-jetty12 (1.14.2)

io.micrometer:micrometer-jetty12 MAVEN version 1.14.2 is affected by a known vulnerability. The following packages have a transitive dependency on io.micrometer:micrometer-jetty12 and may be impacted: - io.javalin:javalin-micrometer 7.0.0-alpha.3 Source cves: CVE-2026-40984 Source advisory:...

io.micrometer:micrometer-atlas-starter (0.8.0.release), io.micrometer:micrometer-datadog-starter (0.8.0.release) +5 more potentially affected by CVE-2026-40984 via io.micrometer:micrometer-core (0.8.0.release)

io.micrometer:micrometer-core MAVEN version 0.8.0.release is affected by a known vulnerability. The following packages have a transitive dependency on io.micrometer:micrometer-core and may be impacted: - io.micrometer:micrometer-atlas-starter 0.8.0.release - io.micrometer:micrometer-datadog-start...

com.linecorp.armeria:armeria (>=0.53.0, <=0.54.2), com.linecorp.armeria:armeria-grpc (>=0.53.0, <=0.54.2) +49 more potentially affected by CVE-2026-40984 via io.micrometer:micrometer-core (0.10.0.release)

io.micrometer:micrometer-core MAVEN version 0.10.0.release is affected by a known vulnerability. The following packages have a transitive dependency on io.micrometer:micrometer-core and may be impacted: - com.linecorp.armeria:armeria =0.53.0, =0.53.0, =0.53.0, =0.53.0, =0.53.0, =0.53.0, =0.53.0,...

io.javalin:javalin-bundle (>=6.6.0, <=6.7.0), io.javalin:javalin-micrometer (>=6.6.0, <=6.7.0) +1 more potentially affected by CVE-2026-40984 via io.micrometer:micrometer-jetty11 (>=1.14.2, <=1.14.5)

io.micrometer:micrometer-jetty11 MAVEN version =1.14.2, =6.6.0, =6.6.0, =6.7.0 - org.apache.zeppelin:zeppelin-server 0.12.1 Source cves: CVE-2026-40984 Source advisory: OSV:GHSA-G3PR-3P32-FP23...