Io Micrometer
Monthly
Heap exhaustion via unbounded memory leak in micrometer-core affects Java applications using Apache HttpAsyncClient (4.x or 5.x) instrumented with MicrometerHttpClientInterceptor. When asynchronous HTTP requests fail before receiving any server response - due to connection resets, network timeouts, or unreachable endpoints - the per-request tracking state allocated by the interceptor is never released, accumulating indefinitely on the JVM heap. Sustained failure conditions (such as a misbehaving or attacker-controlled upstream server) can drive heap exhaustion to OutOfMemoryError, crashing the instrumented application. No public exploit identified at time of analysis, and the vulnerability is not listed in CISA KEV.
Heap exhaustion via unbounded memory leak in micrometer-core affects Java applications using Apache HttpAsyncClient (4.x or 5.x) instrumented with MicrometerHttpClientInterceptor. When asynchronous HTTP requests fail before receiving any server response - due to connection resets, network timeouts, or unreachable endpoints - the per-request tracking state allocated by the interceptor is never released, accumulating indefinitely on the JVM heap. Sustained failure conditions (such as a misbehaving or attacker-controlled upstream server) can drive heap exhaustion to OutOfMemoryError, crashing the instrumented application. No public exploit identified at time of analysis, and the vulnerability is not listed in CISA KEV.