CVE-2026-40984CWE-400CWE-770denial-of-service

CVE-2026-40984

High · published June 9, 2026

CVSS v3.1

7.5

EPSS

Percentile

64.4

In the wild

Unconfirmed

What it is

In Micrometer, it is possible for a user to provide specially crafted HTTP requests that may cause a denial-of-service (DoS) condition.

Affected versions:

micrometer-core 1.16.0 through 1.16.5; 1.15.0 through 1.15.11; 1.14.0 through 1.14.15; 1.13.0 through 1.13.18; 1.9.0 through 1.9.17.

micrometer-jetty11 1.16.0 through 1.16.5; 1.15.0 through 1.15.11; 1.14.0 through 1.14.15; 1.13.0 through 1.13.18.

micrometer-jetty12 1.16.0 through 1.16.5; 1.15.0 through 1.15.11; 1.14.0 through 1.14.15; 1.13.0 through 1.13.18.

The record

Technical detail

CVSS v3.1: 7.5 · HIGH
Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
CVSS v4.0: Not supplied
EPSS: 0.01065 · 64.4th percentile
Weaknesses: CWE-400 · Uncontrolled Resource Consumption; CWE-770 · Allocation of Resources Without Limits or Throttling
Published: 2026-06-09T09:16Z

References (13)

EPSS history

Timeline

09 JUN 03:47Z
Micrometer HTTP server instrumentations DoS vulnerability
cvelistv5