CVE-2026-40983: VMware Micrometer denial of service via crafted gRPC requests

Executive brief

Micrometer is a popular metrics collection library used by Java applications to monitor performance and health. A vulnerability in its gRPC server monitoring component allows an attacker to send specially crafted requests that exhaust system resources. This can lead to a denial-of-service (DoS) condition, making the affected application unavailable to legitimate users.

Technical details

A resource consumption vulnerability (CWE-400/CWE-770) exists in the Micrometer gRPC server instrumentation. The component fails to properly limit or throttle resources allocated during the processing of gRPC requests. A remote, unauthenticated attacker can exploit this by sending specially crafted gRPC requests to the server, leading to uncontrolled resource consumption and a denial-of-service (DoS) state. The issue is fixed in Micrometer versions 1.16.6 and 1.15.12.

Affected products

• Micrometer micrometer-core 1.16.0 through 1.16.5, 1.15.0 through 1.15.11

Timeline

• 2026-06-09: disclosed
• 2026-06-09: advisory

References

• https://api.github.com/users/julianladisch
• https://github.com/julianladisch
• https://api.github.com/users/julianladisch/gists%7B/gist_id%7D
• https://api.github.com/users/julianladisch/repos
• https://avatars.githubusercontent.com/u/533612?v=4
• https://api.github.com/users/julianladisch/events%7B/privacy%7D