Skip to content
fr Sign in
7.5 High

CVE-2026-40984 In Micrometer, it is possible for a user to provide specially crafted HTTP requests that may cause a denial-of-service…

Description

In Micrometer, it is possible for a user to provide specially crafted HTTP requests that may cause a denial-of-service (DoS) condition. Affected versions: micrometer-core 1.16.0 through 1.16.5; 1.15.0 through 1.15.11; 1.14.0 through 1.14.15; 1.13.0 through 1.13.18; 1.9.0 through 1.9.17. micrometer-jetty11 1.16.0 through 1.16.5; 1.15.0 through 1.15.11; 1.14.0 through 1.14.15; 1.13.0 through 1.13.18. micrometer-jetty12 1.16.0 through 1.16.5; 1.15.0 through 1.15.11; 1.14.0 through 1.14.15; 1.13.0 through 1.13.18.

Affected products and versions

Product Affected versions Fixed in
Micrometer 1.16 1.16.0 → < 1.16.6 1.16.6
Micrometer 1.15 1.15.0 → latest No fix stated
Micrometer 1.14 1.14.0 → < 1.14.15.1 1.14.15.1
Micrometer 1.13 1.13.0 → < 1.13.19 1.13.19
Red Hat AMQ Broker 7 Versions not published
Red Hat AMQ Clients Versions not published
Red Hat build of Apache Camel - HawtIO 4 Versions not published
Red Hat build of Apache Camel 4 for Quarkus 3 Versions not published
Red Hat build of Apache Camel for Spring Boot 4 Versions not published
Show the 22 other branches
Product Affected versions Fixed in
Red Hat build of Apicurio Registry 3 Versions not published
Red Hat build of Debezium 3 Versions not published
Red Hat Build of Keycloak Versions not published
Red Hat build of OptaPlanner 8 Versions not published
Red Hat build of Quarkus Versions not published
Red Hat Data Grid 8 Versions not published
Red Hat Fuse 7 Versions not published
Red Hat JBoss Enterprise Application Platform Expansion Pack Versions not published
Red Hat Process Automation 7 Versions not published
streams for Apache Kafka 2 Versions not published
streams for Apache Kafka 3 Versions not published
Red Hat OpenShift AI (RHOAI) Versions not published
Red Hat OpenShift Dev Spaces Versions not published
Red Hat Build of Apache Camel 4.18 for Quarkus 3.33 Versions not published
Red Hat build of Apache Camel 4.18.1.P1 for Spring Boot 3.5.16 Versions not published
Red Hat Data Grid 8.6.2 Versions not published
Red Hat build of Keycloak 26.6 26.6 earliest → < 26.6-11 26.6-11
Red Hat build of Keycloak 26.6.5 Versions not published
Streams for Apache Kafka 3.2.1 Versions not published
Red Hat OpenShift Dev Spaces 3.30 1787759723 earliest → < 1787759723 1787759723
Red Hat AMQ Broker 7.13.6 Versions not published
Red Hat AMQ Broker 7.14.1 Versions not published

References

Timeline

  1. Published
  2. Last modified

Other CVEs of Micrometer

The 4 CVEs of Micrometer →
CVE-2026-59295 It is possible for outbound HTTP requests using a Micrometer-instrumented client to cause a denial-of-service (DoS)… 5.9 Medium CVE-2026-59296 Using untrusted, non-normalized input as-is for metrics data (such as metric names, tag keys, or tag values) is a… 5.9 Medium CVE-2026-40983 In Micrometer, it is possible for a user to provide specially crafted gRPC requests that may cause a denial-of-service… 7.5 High
Track this CVE