CVE-2026-59295

CVE-2026-59295 affects applications using MicrometerHttpClientInterceptor to instrument Apache HttpAsyncClient (4.x or 5.x). When asynchronous requests fail before receiving a response—such as connection resets or timeouts—the per-request tracking state is never released, causing an unbounded mem...

PT-2026-80797

Micrometer-instrumented Apache HttpAsyncClient 4.x or 5.x usage via MicrometerHttpClientInterceptor can leak memory unboundedly when asynchronous requests fail before receiving a response e.g. connection resets or timeouts. Tracking state for these requests remains in memory indefinitely, and...