Micrometer gRPC server instrumentation DoS vulnerability
In Micrometer, it is possible for a user to provide specially crafted gRPC requests that may cause a denial-of-service (DoS) condition.
Affected versions:
Micrometer 1.16.0 through 1.16.5; 1.15.0 through 1.15.11.
An unauthenticated remote attacker can cause denial of service by sending specially crafted gRPC requests that trigger excessive resource consumption in applications using Micrometer's ObservationGrpcServerInterceptor.
CAPEC ID: N/A
Description: An unauthenticated remote attacker can cause denial of service by sending specially crafted gRPC requests that trigger excessive resource consumption in applications using Micrometer's ObservationGrpcServerInterceptor.
2. micrometer: micrometer-core: Micrometer: Denial of Service via specially crafted gRPC requests
A flaw was found in Micrometer. A remote attacker can provide specially crafted gRPC (gRPC Remote Procedure Call) requests, which may lead to a denial-of-service (DoS) condition. This vulnerability allows an attacker to disrupt the availability of the affected system.
RHSA-2026:36839: Red Hat Build of Apache Camel 4.18 for Quarkus 3.33
RHSA-2026:41951: Red Hat Data Grid 8.6.2
Configurations
Workarounds
To mitigate this issue, restrict network access to services exposing Micrometer's gRPC endpoints to trusted clients only. Implement firewall rules to limit inbound connections to the specific ports used by gRPC. If gRPC functionality is not essential for the deployment, consider disabling it entirely to eliminate the attack vector. Any changes to network configurations or service settings may require a service restart to take effect, potentially impacting availability during the transition.