Executive brief
Micrometer is a metrics collection library used by many Java-based web applications to monitor performance. A vulnerability in how it handles web requests allows an attacker to send specially crafted data that exhausts system resources. This can lead to a denial-of-service (DoS) condition, making the affected application slow or completely unavailable to legitimate users.
Technical details
A denial-of-service (DoS) vulnerability exists in Micrometer's HTTP server instrumentation components, including micrometer-core and Jetty-specific modules. The flaw is categorized under CWE-400 (Uncontrolled Resource Consumption) and CWE-770 (Allocation of Resources Without Limits or Throttling). An unauthenticated remote attacker can exploit this by sending specially crafted HTTP requests that trigger excessive resource allocation or maintenance. This leads to resource exhaustion, effectively crashing or hanging the server instrumentation. Patches have been released in versions 1.16.6 and 1.15.12 to address the issue.
Affected products
- Micrometer micrometer-core 1.16.0-1.16.5, 1.15.0-1.15.11, 1.14.0-1.14.15, 1.13.0-1.13.18, 1.9.0-1.9.17
- Micrometer micrometer-jetty11 1.16.0-1.16.5, 1.15.0-1.15.11, 1.14.0-1.14.15, 1.13.0-1.13.18
- Micrometer micrometer-jetty12 1.16.0-1.16.5, 1.15.0-1.15.11, 1.14.0-1.14.15, 1.13.0-1.13.18
Timeline
- 2026-06-09: disclosed
- 2026-06-09: advisory