CVE-2026-59295

CVE-2026-59295 affects applications using MicrometerHttpClientInterceptor to instrument Apache HttpAsyncClient (4.x or 5.x). When asynchronous requests fail before receiving a response—such as connection resets or timeouts—the per-request tracking state is never released, causing an unbounded mem...