EUVD-2026-64774
GHSA-v7hr-hgg3-vv6q
Severity by source
AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H
Network-triggerable via attacker-controlled upstream server, but AC:H for required Micrometer+HttpAsyncClient configuration and sustained failures; no C/I impact.
Primary rating from Vendor (vmware).
CVSS VectorVendor: vmware
Lifecycle Timeline
2DescriptionCVE.org
Micrometer-instrumented Apache HttpAsyncClient (4.x or 5.x) usage via MicrometerHttpClientInterceptor can leak memory unboundedly when asynchronous requests fail before receiving a response (e.g. connection resets or timeouts). Tracking state for these requests remains in memory indefinitely, and sustained failures lead to heap exhaustion and OutOfMemoryError crashes.
AnalysisAI
Heap exhaustion via unbounded memory leak in micrometer-core affects Java applications using Apache HttpAsyncClient (4.x or 5.x) instrumented with MicrometerHttpClientInterceptor. When asynchronous HTTP requests fail before receiving any server response - due to connection resets, network timeouts, or unreachable endpoints - the per-request tracking state allocated by the interceptor is never released, accumulating indefinitely on the JVM heap. …
Unlock full vulnerability intelligence
- Risk assessment & exploitation conditions
- Attack chain visualization
- Remediation with exact patch versions
- Threat intelligence from 22 sources
- Personal watchlist & email alerts
Free forever · No credit card required
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata
Vulnerability AssessmentAI
| Exploitation | Exploitation requires the target application to be using Apache HttpAsyncClient version 4.x or 5.x instrumented via Micrometer's MicrometerHttpClientInterceptor - this is a non-default, explicitly configured combination and is not present in all Micrometer deployments. … Additional conditions and limiting factors are described in the full assessment. |
| Risk Assessment | The official CVSS 3.1 score of 5.9 (AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H) accurately captures the principal risk signals: the availability impact is High (JVM crash), but attack complexity is also High, reflecting the requirement that the attacker must be able to cause sustained async request failures against a specifically configured target. … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in. |
| Exploit Scenario | Full exploit scenario with step-by-step reproduction available after sign-in. |
| Remediation | Consult the Spring project security advisory at https://spring.io/security/cve-2026-59295 and GitHub Security Advisory GHSA-747c-jhq3-w433 for the patched release version of micrometer-core; upgrade to the confirmed fixed version as the primary remediation. … Detailed patch versions, workarounds, and compensating controls in full report. |
Threat intelligence, references, and detailed analysis are available after sign-in.
Same weakness CWE-401 – Memory Leak
View allSame technique Denial Of Service
View allVendor StatusVendor
Share
External POC / Exploit Code
Leaving vuln.today