Logo
-

Byte Open Security

(ByteOS Network)

Log In

Sign Up

ByteOS

Security
Vulnerability Details
Registries
Custom Views
Weaknesses
Attack Patterns
Filters & Tools
CVE Vulnerability Details :
CVE-2026-40984
PUBLISHED
More InfoOfficial Page
Assigner-vmware
Assigner Org ID-dcf2e128-44bd-42ed-91e8-88f912c1401d
View Known Exploited Vulnerability (KEV) details
Published At-09 Jun, 2026 | 03:47
Updated At-21 Jul, 2026 | 12:05
Rejected At-
â–¼CVE Numbering Authority (CNA)
Micrometer HTTP server instrumentations DoS vulnerability

In Micrometer, it is possible for a user to provide specially crafted HTTP requests that may cause a denial-of-service (DoS) condition. Affected versions: micrometer-core 1.16.0 through 1.16.5; 1.15.0 through 1.15.11; 1.14.0 through 1.14.15; 1.13.0 through 1.13.18; 1.9.0 through 1.9.17. micrometer-jetty11 1.16.0 through 1.16.5; 1.15.0 through 1.15.11; 1.14.0 through 1.14.15; 1.13.0 through 1.13.18. micrometer-jetty12 1.16.0 through 1.16.5; 1.15.0 through 1.15.11; 1.14.0 through 1.14.15; 1.13.0 through 1.13.18.

Affected Products
Vendor
VMware (Broadcom Inc.)Spring
Product
Micrometer
Package Name
micrometer-core
Default Status
unaffected
Versions
Affected
  • From 1.16.0 before 1.16.5.1 (custom)
  • From 1.15.0 before 1.15.11.1 (custom)
  • From 1.14.0 before 1.14.16 (custom)
  • From 1.13.0 before 1.13.19 (custom)
  • From 1.9.0 before 1.9.18 (custom)
Vendor
VMware (Broadcom Inc.)Spring
Product
Micrometer
Package Name
micrometer-jetty11
Default Status
unaffected
Versions
Affected
  • From 1.16.0 before 1.16.5.1 (custom)
  • From 1.15.0 before 1.15.11.1 (custom)
  • From 1.14.0 before 1.14.16 (custom)
  • From 1.13.0 before 1.13.19 (custom)
Vendor
VMware (Broadcom Inc.)Spring
Product
Micrometer
Package Name
micrometer-jetty12
Default Status
unaffected
Versions
Affected
  • From 1.16.0 before 1.16.6 (custom)
  • From 1.15.0 before 1.15.11. (custom)
  • From 1.14.0 before 1.14.15.1 (custom)
  • From 1.13.0 before 1.13.19 (custom)
Problem Types
TypeCWE IDDescription
CWECWE-400CWE-400: Uncontrolled Resource Consumption
Type: CWE
CWE ID: CWE-400
Description: CWE-400: Uncontrolled Resource Consumption
Metrics
VersionBase scoreBase severityVector
3.17.5HIGH
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Version: 3.1
Base score: 7.5
Base severity: HIGH
Vector:
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Metrics Other Info
Impacts
CAPEC IDDescription
N/AAn unauthenticated remote attacker can cause denial of service by sending specially crafted HTTP requests that trigger excessive resource consumption in applications using Micrometer HTTP server instrumentations.
CAPEC ID: N/A
Description: An unauthenticated remote attacker can cause denial of service by sending specially crafted HTTP requests that trigger excessive resource consumption in applications using Micrometer HTTP server instrumentations.
Solutions
Configurations
Workarounds
Exploits
Credits
Timeline
EventDate
Replaced By
Rejected Reason
References
HyperlinkResource
https://spring.io/security/cve-2026-40984
N/A
Hyperlink: https://spring.io/security/cve-2026-40984
Resource: N/A
â–¼Authorized Data Publishers (ADP)
1. CISA ADP Vulnrichment
Affected Products
Metrics
VersionBase scoreBase severityVector
Metrics Other Info
Impacts
CAPEC IDDescription
Solutions
Configurations
Workarounds
Exploits
Credits
Timeline
EventDate
Replaced By
Rejected Reason
References
HyperlinkResource
2. micrometer-core: micrometer-jetty11: micrometer-jetty12: Micrometer: Denial of Service via specially crafted HTTP requests

A flaw was found in Micrometer. A remote attacker can provide specially crafted HTTP requests, which may lead to a denial-of-service (DoS) condition. This vulnerability allows an attacker to disrupt the availability of the affected system.

Affected Products
Vendor
Red Hat, Inc.Red Hat
Product
Red Hat build of Apache Camel 4.18.1.P1 for Spring Boot 3.5.16
Collection URL
https://access.redhat.com/downloads/content/package-browser/
Package Name
micrometer-core
CPEs
  • cpe:/a:redhat:apache_camel_spring_boot:4.18
Default Status
unaffected
Vendor
Red Hat, Inc.Red Hat
Product
Red Hat Build of Apache Camel 4.18 for Quarkus 3.33
Collection URL
https://access.redhat.com/downloads/content/package-browser/
Package Name
micrometer-core
CPEs
  • cpe:/a:redhat:apache_camel_quarkus:3.33
Default Status
unaffected
Vendor
Red Hat, Inc.Red Hat
Product
Red Hat Data Grid 8.6.2
Collection URL
https://access.redhat.com/downloads/content/package-browser/
Package Name
micrometer-core
CPEs
  • cpe:/a:redhat:jboss_data_grid:8
Default Status
unaffected
Vendor
Red Hat, Inc.Red Hat
Product
Red Hat AMQ Broker 7
Collection URL
https://access.redhat.com/downloads/content/package-browser/
Package Name
micrometer-core
CPEs
  • cpe:/a:redhat:amq_broker:7
Default Status
affected
Vendor
Red Hat, Inc.Red Hat
Product
Red Hat AMQ Clients
Collection URL
https://access.redhat.com/downloads/content/package-browser/
Package Name
micrometer-core
CPEs
  • cpe:/a:redhat:amq_clients:2023
Default Status
affected
Vendor
Red Hat, Inc.Red Hat
Product
Red Hat build of Apache Camel 4 for Quarkus 3
Collection URL
https://access.redhat.com/downloads/content/package-browser/
Package Name
micrometer-core
CPEs
  • cpe:/a:redhat:camel_quarkus:3
Default Status
affected
Vendor
Red Hat, Inc.Red Hat
Product
Red Hat build of Apache Camel - HawtIO 4
Collection URL
https://access.redhat.com/downloads/content/package-browser/
Package Name
micrometer-core
CPEs
  • cpe:/a:redhat:apache_camel_hawtio:4
Default Status
affected
Vendor
Red Hat, Inc.Red Hat
Product
Red Hat build of Apicurio Registry 3
Collection URL
https://access.redhat.com/downloads/content/package-browser/
Package Name
micrometer-core
CPEs
  • cpe:/a:redhat:apicurio_registry:3
Default Status
affected
Vendor
Red Hat, Inc.Red Hat
Product
Red Hat build of Debezium 3
Collection URL
https://access.redhat.com/downloads/content/package-browser/
Package Name
micrometer-core
CPEs
  • cpe:/a:redhat:debezium:3
Default Status
affected
Vendor
Red Hat, Inc.Red Hat
Product
Red Hat Build of Keycloak
Collection URL
https://access.redhat.com/downloads/content/package-browser/
Package Name
micrometer-core
CPEs
  • cpe:/a:redhat:build_keycloak:
Default Status
affected
Vendor
Red Hat, Inc.Red Hat
Product
Red Hat Build of Keycloak
Collection URL
https://access.redhat.com/downloads/content/package-browser/
Package Name
rhbk/keycloak-rhel9
CPEs
  • cpe:/a:redhat:build_keycloak:
Default Status
affected
Vendor
Red Hat, Inc.Red Hat
Product
Red Hat Build of Keycloak
Collection URL
https://access.redhat.com/downloads/content/package-browser/
Package Name
rhbk/keycloak-rhel9-operator
CPEs
  • cpe:/a:redhat:build_keycloak:
Default Status
affected
Vendor
Red Hat, Inc.Red Hat
Product
Red Hat Build of Keycloak
Collection URL
https://access.redhat.com/downloads/content/package-browser/
Package Name
rhbk-openshift-rhel9/rhbk-openshift-rhel9
CPEs
  • cpe:/a:redhat:build_keycloak:
Default Status
affected
Vendor
Red Hat, Inc.Red Hat
Product
Red Hat Build of Keycloak
Collection URL
https://access.redhat.com/downloads/content/package-browser/
Package Name
rhbk-rhel9-operator/rhbk-rhel9-operator
CPEs
  • cpe:/a:redhat:build_keycloak:
Default Status
affected
Vendor
Red Hat, Inc.Red Hat
Product
Red Hat build of OptaPlanner 8
Collection URL
https://access.redhat.com/downloads/content/package-browser/
Package Name
micrometer-core
CPEs
  • cpe:/a:redhat:optaplanner:::el6
Default Status
affected
Vendor
Red Hat, Inc.Red Hat
Product
Red Hat build of Quarkus
Collection URL
https://access.redhat.com/downloads/content/package-browser/
Package Name
micrometer-core
CPEs
  • cpe:/a:redhat:quarkus:3
Default Status
affected
Vendor
Red Hat, Inc.Red Hat
Product
Red Hat Fuse 7
Collection URL
https://access.redhat.com/downloads/content/package-browser/
Package Name
micrometer-core
CPEs
  • cpe:/a:redhat:jboss_fuse:7
Default Status
unknown
Vendor
Red Hat, Inc.Red Hat
Product
Red Hat JBoss Enterprise Application Platform Expansion Pack
Collection URL
https://access.redhat.com/downloads/content/package-browser/
Package Name
micrometer-core
CPEs
  • cpe:/a:redhat:jbosseapxp
Default Status
affected
Vendor
Red Hat, Inc.Red Hat
Product
Red Hat OpenShift AI (RHOAI)
Collection URL
https://access.redhat.com/downloads/content/package-browser/
Package Name
rhoai/odh-trustyai-service-rhel9
CPEs
  • cpe:/a:redhat:openshift_ai
Default Status
unaffected
Vendor
Red Hat, Inc.Red Hat
Product
Red Hat OpenShift Dev Spaces
Collection URL
https://access.redhat.com/downloads/content/package-browser/
Package Name
devspaces/openvsx-rhel9
CPEs
  • cpe:/a:redhat:openshift_devspaces:3
Default Status
affected
Vendor
Red Hat, Inc.Red Hat
Product
Red Hat OpenShift Dev Spaces
Collection URL
https://access.redhat.com/downloads/content/package-browser/
Package Name
devspaces/pluginregistry-rhel9
CPEs
  • cpe:/a:redhat:openshift_devspaces:3
Default Status
affected
Vendor
Red Hat, Inc.Red Hat
Product
Red Hat OpenShift Dev Spaces
Collection URL
https://access.redhat.com/downloads/content/package-browser/
Package Name
devspaces/server-rhel9
CPEs
  • cpe:/a:redhat:openshift_devspaces:3
Default Status
unknown
Vendor
Red Hat, Inc.Red Hat
Product
Red Hat Process Automation 7
Collection URL
https://access.redhat.com/downloads/content/package-browser/
Package Name
micrometer-core
CPEs
  • cpe:/a:redhat:jboss_enterprise_bpms_platform:7
Default Status
affected
Vendor
Red Hat, Inc.Red Hat
Product
streams for Apache Kafka 2
Collection URL
https://access.redhat.com/downloads/content/package-browser/
Package Name
micrometer-core
CPEs
  • cpe:/a:redhat:amq_streams:2
Default Status
affected
Vendor
Red Hat, Inc.Red Hat
Product
streams for Apache Kafka 3
Collection URL
https://access.redhat.com/downloads/content/package-browser/
Package Name
micrometer-core
CPEs
  • cpe:/a:redhat:amq_streams:3
Default Status
affected
Problem Types
TypeCWE IDDescription
CWECWE-770Allocation of Resources Without Limits or Throttling
Type: CWE
CWE ID: CWE-770
Description: Allocation of Resources Without Limits or Throttling
Metrics
VersionBase scoreBase severityVector
3.17.5HIGH
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Version: 3.1
Base score: 7.5
Base severity: HIGH
Vector:
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Metrics Other Info
Red Hat severity rating
value:
Important
namespace:
https://access.redhat.com/security/updates/classification/
Impacts
CAPEC IDDescription
Solutions

RHSA-2026:36839: Red Hat Build of Apache Camel 4.18 for Quarkus 3.33

RHSA-2026:41951: Red Hat Data Grid 8.6.2

RHSA-2026:37390: Red Hat build of Apache Camel 4.18.1.P1 for Spring Boot 3.5.16

Configurations
Workarounds
Exploits
Credits
Timeline
EventDate
Reported to Red Hat.2026-06-09 05:01:51
Made public.2026-06-09 03:47:46
Event: Reported to Red Hat.
Date: 2026-06-09 05:01:51
Event: Made public.
Date: 2026-06-09 03:47:46
Replaced By
Rejected Reason
References
HyperlinkResource
https://access.redhat.com/security/cve/CVE-2026-40984
vdb-entry
x_refsource_REDHAT
https://bugzilla.redhat.com/show_bug.cgi?id=2486716
issue-tracking
x_refsource_REDHAT
https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-40984.json
x_sadp-csaf-vex
https://access.redhat.com/errata/RHSA-2026:36839
vendor-advisory
x_refsource_REDHAT
https://access.redhat.com/errata/RHSA-2026:41951
vendor-advisory
x_refsource_REDHAT
https://access.redhat.com/errata/RHSA-2026:37390
vendor-advisory
x_refsource_REDHAT
Hyperlink: https://access.redhat.com/security/cve/CVE-2026-40984
Resource:
vdb-entry
x_refsource_REDHAT
Hyperlink: https://bugzilla.redhat.com/show_bug.cgi?id=2486716
Resource:
issue-tracking
x_refsource_REDHAT
Hyperlink: https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-40984.json
Resource:
x_sadp-csaf-vex
Hyperlink: https://access.redhat.com/errata/RHSA-2026:36839
Resource:
vendor-advisory
x_refsource_REDHAT
Hyperlink: https://access.redhat.com/errata/RHSA-2026:41951
Resource:
vendor-advisory
x_refsource_REDHAT
Hyperlink: https://access.redhat.com/errata/RHSA-2026:37390
Resource:
vendor-advisory
x_refsource_REDHAT
Details not found