CVE-2026-40984

Micrometer HTTP server instrumentations DoS vulnerability

HIGH

7.5

CVSS Score

Published: June 9, 2026 at 03:47 AM UTC

Updated: September 14, 2026 at 01:18 PM UTC

10 products affected across 2 vendorsJBoss Enterprise Application Platform Expansion PackBuild of Apicurio RegistryProcess Automation

Using Micrometer by Spring?

Get instant alerts when new vulnerabilities affect Micrometer - before attackers find them.

Real-time alertsTrack your software stackFree plan available

Start Free Sign In

Severity

HIGH7.5

Exploit prediction

EPSS 0.8%

SSVC

No known exploit

Description

In Micrometer, it is possible for a user to provide specially crafted HTTP requests that may cause a denial-of-service (DoS) condition. Affected versions: micrometer-core 1.16.0 through 1.16.5; 1.15.0 through 1.15.11; 1.14.0 through 1.14.15; 1.13.0 through 1.13.18; 1.9.0 through 1.9.17. micrometer-jetty11 1.16.0 through 1.16.5; 1.15.0 through 1.15.11; 1.14.0 through 1.14.15; 1.13.0 through 1.13.18. micrometer-jetty12 1.16.0 through 1.16.5; 1.15.0 through 1.15.11; 1.14.0 through 1.14.15; 1.13.0 through 1.13.18.

Affected

Our own answer: ranges merged, affected separated from platform-only, with confidence and review flags.

Build of Apache Camel for Quarkus · Red Hatrpm

60%

Build of Apache Camel - HawtIO · Red Hatrpm

60%

Build of Apicurio Registry · Red Hatrpm

60%

Build of Debezium · Red Hatrpm

60%

Build of Optaplanner · Red Hatrpm

60%

JBoss Amq Clients · Red Hatrpm

60%

All versions

JBoss Enterprise Application Platform Expansion Pack · Red Hatrpm

60%

All versions

Process Automation · Red Hatrpm

60%

Streams for Apache Kafka · Red Hatrpm

60%

Vendor states this is fixed in 3.2.1 (unaffected)

Micrometer · Spring

60%

1.13.0 ≤ v < 1.13.191.14.0 ≤ v < 1.14.15.11.14.0 ≤ v < 1.14.161.15.0 ≤ v < 1.15.11.1.15.0 ≤ v < 1.15.11.11.16.0 ≤ v < 1.16.5.11.16.0 ≤ v < 1.16.61.9.0 ≤ v < 1.9.181.13.0 1.14.0 1.15.0 1.16.0 1.9.0

Affected range stops below 1.13.19, so it looks safe — our inference, not a vendor statement

Affected range stops below 1.14.15.1, so it looks safe — our inference, not a vendor statement

Affected range stops below 1.14.16, so it looks safe — our inference, not a vendor statement

Affected range stops below 1.15.11., so it looks safe — our inference, not a vendor statement

Affected range stops below 1.15.11.1, so it looks safe — our inference, not a vendor statement

Affected range stops below 1.16.5.1, so it looks safe — our inference, not a vendor statement

Affected range stops below 1.16.6, so it looks safe — our inference, not a vendor statement

Affected range stops below 1.9.18, so it looks safe — our inference, not a vendor statement

Remediation

No guide yet

No remediation guidance has been written for this CVE yet, and no fixed version or vendor advisory is recorded against it.