EUVD-2026-35320
GHSA-g3pr-3p32-fp23
Severity by source
AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Primary rating from Vendor (vmware).
CVSS VectorVendor: vmware
Lifecycle Timeline
2Blast Radius
ecosystem impact- 848 maven packages depend on io.micrometer:micrometer-core (124 direct, 725 indirect)
Ecosystem-wide dependent count for version 1.16.0.
DescriptionCVE.org
In Micrometer, it is possible for a user to provide specially crafted HTTP requests that may cause a denial-of-service (DoS) condition.
Affected versions: micrometer-core 1.16.0 through 1.16.5; 1.15.0 through 1.15.11; 1.14.0 through 1.14.15; 1.13.0 through 1.13.18; 1.9.0 through 1.9.17. micrometer-jetty11 1.16.0 through 1.16.5; 1.15.0 through 1.15.11; 1.14.0 through 1.14.15; 1.13.0 through 1.13.18. micrometer-jetty12 1.16.0 through 1.16.5; 1.15.0 through 1.15.11; 1.14.0 through 1.14.15; 1.13.0 through 1.13.18.
AnalysisAI
Denial-of-service in Micrometer (micrometer-core, micrometer-jetty11, and micrometer-jetty12) allows remote unauthenticated attackers to exhaust resources by sending specially crafted HTTP requests against applications that expose Micrometer-instrumented endpoints. The flaw affects a wide swath of supported 1.9.x through 1.16.x release lines and carries a CVSS 7.5 (availability-only) impact. No public exploit identified at time of analysis and the issue is not listed in CISA KEV.
Technical ContextAI
Micrometer is the de facto application metrics facade for the JVM, used by Spring Boot and many Jetty-based services to expose observability data (counters, timers, distributions) to backends like Prometheus, Datadog, and others. The micrometer-jetty11/jetty12 modules instrument the Jetty 11 and 12 HTTP server request lifecycle, meaning crafted request attributes (URI path, headers, or routing metadata) are processed during metric tagging. The CWE-400 (Uncontrolled Resource Consumption) classification indicates that some request-derived input is allowed to inflate cardinality, allocate unbounded structures, or otherwise consume CPU/memory disproportionately to the request size, which is a classic pitfall for HTTP metric instrumentation libraries that derive tags from request data.
RemediationAI
Upgrade to a fixed Micrometer release line above the listed affected ranges - i.e., beyond 1.9.17 on the 1.9.x line, beyond 1.13.18, 1.14.15, 1.15.11, and 1.16.5 on their respective maintenance branches - by consulting the Spring advisory at https://spring.io/security/cve-2026-40984 for the exact patched build numbers, since exact fix versions are not enumerated in the supplied data (Patch available per vendor advisory). Because Micrometer is almost always pulled in transitively by Spring Boot or other frameworks, audit your dependency tree (mvn dependency:tree / gradle dependencies) and override the micrometer-core, micrometer-jetty11, and micrometer-jetty12 versions explicitly. As a compensating control until patching, place the affected service behind a reverse proxy or WAF that enforces strict URI length, header size, and request-rate limits, and restrict exposure of any /actuator or metrics endpoints to internal networks only; note this does not stop the DoS if any instrumented HTTP path is publicly reachable, since the vulnerability is triggered during request instrumentation rather than at the metrics endpoint itself.
Spring Cloud Gateway Server Webflux may be vulnerable to Spring Environment property modification. Rated critical severi
Access control bypass in SpringBlade v4.5.0 importUser function allows low-privileged users to import sensitive user dat
Spring Cloud Config Server contains a path traversal vulnerability when using the native file system backend, allowing u
Spring Framework MVC applications can be vulnerable to a “Path Traversal Vulnerability” when deployed on a non-compliant
SpringBlade v4.5.0 has an access control flaw in authRoutes allowing low-privileged users to escalate to admin through t
Remote code execution in Spring for GraphQL versions 1.3.0-1.3.8, 1.4.0-1.4.5, and 2.0.0-2.0.3 allows unauthenticated at
Server-Sent Events (SSE) stream corruption affects Spring MVC applications built on the functional web framework across
Spring AI versions 1.0.0 through 1.0.4 and 1.1.0 through 1.1.3 allow unauthenticated remote code execution through Sprin
Unsafe JSON deserialization in Spring Framework's JMS message converters (MappingJackson2MessageConverter and JacksonJso
Spring Security Aspects may not correctly locate method security annotations on private methods. Rated critical severity
Safety-guard bypass in the Spring Framework SpEL engine (VMware/Broadcom) lets attacker-controlled expression input esca
Directory traversal in Spring Cloud Config server module allows remote unauthenticated attackers to read arbitrary files
Same weakness CWE-400 – Uncontrolled Resource Consumption
View allSame technique Denial Of Service
View allVendor StatusVendor
Share
External POC / Exploit Code
Leaving vuln.today