Executive brief
Micrometer is a widely-used instrumentation library that monitors application performance metrics. A memory leak in its HTTP client instrumentation can cause applications to exhaust available memory and become unresponsive (denial of service). This affects any application using Micrometer to track outbound HTTP requests.
Technical details
The vulnerability is an unbounded memory leak in Micrometer's HTTP client instrumentation code. When an HTTP client instrumented with Micrometer makes outbound requests, memory is not properly released, allowing attackers (or normal operation patterns) to accumulate objects in memory without bounds. The attack requires the ability to trigger HTTP requests through the instrumented client, which is typically network-accessible. An attacker can exploit this by sending or triggering many HTTP requests, causing the application's memory consumption to grow until it crashes or becomes unresponsive. Patches are available in Micrometer 1.14.17+, 1.15.13+, 1.16.7+, and 1.17.1+.
Affected products
- VMware Micrometer 1.9.18 and earlier, 1.14.0-1.14.16, 1.15.0-1.15.12, 1.16.0-1.16.6, 1.17.0
Timeline
- 2026-08-24: disclosed