CVE-2026-40984highCWE-400CWE-770

CVE-2026-40984: falha de alta gravidade em Spring Micrometer

Micrometer HTTP server instrumentations DoS vulnerability

Publicada em · Atualizada em

Seguir esta CVE+ Monitorar Micrometer+ Monitorar io.micrometer:micrometer-core

Aviso por e-mail quando ela entrar no KEV, ganhar PoC pública ou subir de nota.

21Vexday Risk Score

Sem sinal de exploração. Nenhum artefato público de exploração conhecido até agora.

ssvc Trackcvss 7.5epss 0.8%
In Micrometer, it is possible for a user to provide specially crafted HTTP requests that may cause a denial-of-service (DoS) condition. Affected versions: micrometer-core 1.16.0 through 1.16.5; 1.15.0 through 1.15.11; 1.14.0 through 1.14.15; 1.13.0 through 1.13.18; 1.9.0 through 1.9.17. micrometer-jetty11 1.16.0 through 1.16.5; 1.15.0 through 1.15.11; 1.14.0 through 1.14.15; 1.13.0 through 1.13.18. micrometer-jetty12 1.16.0 through 1.16.5; 1.15.0 through 1.15.11; 1.14.0 through 1.14.15; 1.13.0 through 1.13.18.
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Produtos afetados
Spring · Micrometer
CVEs relacionadas — Spring Micrometer

No mesmo produto, das mais perigosas para as menos.

CVE-2026-40983HIGHMicrometer gRPC server instrumentation DoS vulnerabilityEPSS 0.6%CVE-2026-59295MEDIUMMicrometer instrumentation of Apache HttpAsyncClient DoS vulnerabilityEPSS 0.4%CVE-2026-59296MEDIUMMicrometer StatsD and Logging meter registries line-protocol and log injection vulnerabilityEPSS 0.3%