io.micrometer/micrometer-registry-statsd: io.micrometer/micrometer-core: Micrometer: Line-protocol and log injection via unsanitized input allows metric and log spoofing

A flaw was found in Micrometer's StatsD and Logging meter registries. This vulnerability allows a remote attacker to inject line terminators into metric data, such as names or tag values, due to insufficient sanitization of untrusted input. Exploitation can lead to the spoofing of arbitrary...

micrometer-core: micrometer-jetty11: micrometer-jetty12: Micrometer: Denial of Service via specially crafted HTTP requests

A flaw was found in Micrometer. A remote attacker can provide specially crafted HTTP requests, which may lead to a denial-of-service DoS condition. This vulnerability allows an attacker to disrupt the availability of the affected system...

micrometer: micrometer-core: Micrometer: Denial of Service via specially crafted gRPC requests

A flaw was found in Micrometer. A remote attacker can provide specially crafted gRPC gRPC Remote Procedure Call requests, which may lead to a denial-of-service DoS condition. This vulnerability allows an attacker to disrupt the availability of the affected system...

ROOT-APP-MAVEN-CVE-2026-40984 CVE-2026-40984 in io.micrometer:micrometer-core - Patched by Root

Root has patched CVE-2026-40984 in the io.micrometer:micrometer-core package for Root:Maven. Multiple fixed versions available...

ROOT-APP-MAVEN-CVE-2026-40983 CVE-2026-40983 in io.micrometer:micrometer-core - Patched by Root

Root has patched CVE-2026-40983 in the io.micrometer:micrometer-core package for Root:Maven. Multiple fixed versions available...

micrometer: micrometer-core: Micrometer: Denial of Service via specially crafted gRPC requests

A flaw was found in Micrometer. A remote attacker can provide specially crafted gRPC gRPC Remote Procedure Call requests, which may lead to a denial-of-service DoS condition. This vulnerability allows an attacker to disrupt the availability of the affected system...

micrometer-core: micrometer-jetty11: micrometer-jetty12: Micrometer: Denial of Service via specially crafted HTTP requests

A flaw was found in Micrometer. A remote attacker can provide specially crafted HTTP requests, which may lead to a denial-of-service DoS condition. This vulnerability allows an attacker to disrupt the availability of the affected system...

io.micrometer/micrometer-registry-statsd: io.micrometer/micrometer-core: Micrometer: Line-protocol and log injection via unsanitized input allows metric and log spoofing

A flaw was found in Micrometer's StatsD and Logging meter registries. This vulnerability allows a remote attacker to inject line terminators into metric data, such as names or tag values, due to insufficient sanitization of untrusted input. Exploitation can lead to the spoofing of arbitrary...

micrometer-core: micrometer-jetty11: micrometer-jetty12: Micrometer: Denial of Service via specially crafted HTTP requests

A flaw was found in Micrometer. A remote attacker can provide specially crafted HTTP requests, which may lead to a denial-of-service DoS condition. This vulnerability allows an attacker to disrupt the availability of the affected system...

micrometer: micrometer-core: Micrometer: Denial of Service via specially crafted gRPC requests

A flaw was found in Micrometer. A remote attacker can provide specially crafted gRPC gRPC Remote Procedure Call requests, which may lead to a denial-of-service DoS condition. This vulnerability allows an attacker to disrupt the availability of the affected system...

micrometer-core: micrometer-jetty11: micrometer-jetty12: Micrometer: Denial of Service via specially crafted HTTP requests

A flaw was found in Micrometer. A remote attacker can provide specially crafted HTTP requests, which may lead to a denial-of-service DoS condition. This vulnerability allows an attacker to disrupt the availability of the affected system...

Denial-Of-Service (DoS)

io.micrometer, micrometer-tracing-bridge-brave is vulnerable to a denial-of-service DoS. The vulnerability is due to improper handling of incoming baggage headers, which allows an attacker to send specially crafted or excessive baggage data that causes unbounded object allocation, potentially...

Improper Input Validation

Micrometer is vulnerable to improper input validation. The vulnerability is due to the use of untrusted, non-normalized input for metric names, tag keys, and tag values, which allows an attacker to supply malicious or unexpected metrics data and potentially cause security or operational issues in...

Denial-Of-Service (DoS)

io.micrometer, micrometer-core is vulnerable to a denial-of-service DoS. The vulnerability is due to improper memory management that can cause memory to grow without bounds during outbound HTTP requests, which allows an attacker to exploit the condition by triggering a large number of HTTP reques...

CVE-2026-59295

A flaw was found in Micrometer Instrumentation for Apache HttpAsyncClient. When asynchronous requests fail before receiving a response, such as due to connection resets or timeouts, the system can leak memory unboundedly. This continuous memory leak leads to heap exhaustion and OutOfMemoryError...

CVE-2026-59296

A flaw was found in Micrometer's StatsD and Logging meter registries. This vulnerability allows a remote attacker to inject line terminators into metric data, such as names or tag values, due to insufficient sanitization of untrusted input. Exploitation can lead to the spoofing of arbitrary...

Missing Release of Memory after Effective Lifetime

Overview Affected versions of this package are vulnerable to Missing Release of Memory after Effective Lifetime via the MicrometerHttpClientInterceptor. An attacker can cause unbounded memory consumption by repeatedly triggering asynchronous request failures before receiving a response, such as...

ai.agentican:agentican-quarkus-metrics (>=0.1.0-alpha.1, <=0.1.0-alpha.4), ai.aletyx.kogito:aletyx-kogito-ai-addons-springboot-adhoc-subprocess (>=0.1.0, <=0.2.0) +19379 more potentially affected by CVE-2026-59295 via io.micrometer:micrometer-core (>=1.0.0-rc.1, <=1.16.6)

io.micrometer:micrometer-core MAVEN version =1.0.0-rc.1, =0.1.0-alpha.1, =0.1.0, =0.1.0, =0.2.0, =0.2.0, =0.2.0, =0.1.1, =0.0.4, =0.1.0, =0.1.3, =0.0.1, =0.1.0, =0.1.4 and more Source cves: CVE-2026-59295 Source advisory: SNYK:JAVA-IOMICROMETER-19256585...

CVE-2026-59295

It is possible for outbound HTTP requests using a Micrometer-instrumented client to cause a denial-of-service DoS condition due to an unbounded memory leak. Micrometer 1.17.0 Micrometer 1.16.0 - 1.16.6 Micrometer 1.15.0 - 1.15.12 Micrometer 1.14.0 - 1.14.16 Micrometer 1.9.18 and earlier...

CVE-2026-59295

It is possible for outbound HTTP requests using a Micrometer-instrumented client to cause a denial-of-service DoS condition due to an unbounded memory leak. Micrometer 1.17.0 Micrometer 1.16.0 - 1.16.6 Micrometer 1.15.0 - 1.15.12 Micrometer 1.14.0 - 1.14.16 Micrometer 1.9.18 and earlier...