7.5
High
CVE-2026-40983 In Micrometer, it is possible for a user to provide specially crafted gRPC requests that may cause a denial-of-service…
Description
In Micrometer, it is possible for a user to provide specially crafted gRPC requests that may cause a denial-of-service (DoS) condition. Affected versions: Micrometer 1.16.0 through 1.16.5; 1.15.0 through 1.15.11.
Affected products and versions
| Product | Affected versions | Fixed in |
|---|---|---|
| Micrometer 1.16 | 1.16.0 → < 1.16.5.1 | 1.16.5.1 |
| Micrometer 1.15 | 1.15.0 → < 1.15.11.1 | 1.15.11.1 |
| Red Hat AMQ Broker 7 | Versions not published | |
| Red Hat AMQ Clients | Versions not published | |
| Red Hat build of Apache Camel - HawtIO 4 | Versions not published | |
| Red Hat build of Apache Camel 4 for Quarkus 3 | Versions not published | |
| Red Hat build of Apicurio Registry 3 | Versions not published | |
| Red Hat Build of Keycloak | Versions not published | |
| Red Hat build of Quarkus | Versions not published |
Show the 17 other branches Hide the 17 other branches
| Product | Affected versions | Fixed in |
|---|---|---|
| Red Hat Data Grid 8 | Versions not published | |
| Red Hat Fuse 7 | Versions not published | |
| Red Hat JBoss Enterprise Application Platform Expansion Pack | Versions not published | |
| streams for Apache Kafka 3 | Versions not published | |
| Red Hat build of Apache Camel for Spring Boot 4 | Versions not published | |
| Red Hat build of Debezium 3 | Versions not published | |
| streams for Apache Kafka 2 | Versions not published | |
| Red Hat OpenShift AI (RHOAI) | Versions not published | |
| Red Hat OpenShift Dev Spaces | Versions not published | |
| Red Hat Satellite 6 | Versions not published | |
| Red Hat Build of Apache Camel 4.18 for Quarkus 3.33 | Versions not published | |
| Red Hat Data Grid 8.6.2 | Versions not published | |
| Red Hat build of Keycloak 26.6 26.6 | earliest → < 26.6-11 | 26.6-11 |
| Red Hat build of Keycloak 26.6.5 | Versions not published | |
| Streams for Apache Kafka 3.2.1 | Versions not published | |
| Red Hat OpenShift Dev Spaces 3.30 1787759723 | earliest → < 1787759723 | 1787759723 |
| Red Hat AMQ Broker 7.14.1 | Versions not published |
References
- spring.io spring.io
Timeline
- Published
- Last modified
Other CVEs of Micrometer
The 4 CVEs of Micrometer →
CVE-2026-59295
It is possible for outbound HTTP requests using a Micrometer-instrumented client to cause a denial-of-service (DoS)…
5.9
Medium
CVE-2026-59296
Using untrusted, non-normalized input as-is for metrics data (such as metric names, tag keys, or tag values) is a…
5.9
Medium
CVE-2026-40984
In Micrometer, it is possible for a user to provide specially crafted HTTP requests that may cause a denial-of-service…
7.5
High