Executive brief
Spring Micrometer Tracing is a library used to collect and track distributed requests across microservices. Applications using W3C baggage propagation with the Brave bridge are vulnerable to denial of service when processing specially crafted baggage headers. An attacker can send malicious requests that cause unbounded memory allocation, exhausting server resources and disrupting service availability.
Technical details
The vulnerability is a denial of service (DoS) caused by unbounded object allocation in the W3C baggage header extraction logic within Micrometer Tracing's Brave bridge. When processing incoming baggage headers, the application fails to enforce limits on the number or size of extracted objects, allowing an attacker to send crafted headers that trigger excessive memory consumption. The vulnerability is network-reachable and requires no authentication; any attacker can send HTTP requests with malicious baggage headers to trigger resource exhaustion. Patches are available in Micrometer Tracing 1.6.7, 1.5.13, and 1.7.1 and later.
Affected products
- Spring Micrometer Tracing 1.4.13 and earlier, 1.5.0-1.5.12, 1.6.0-1.6.6, 1.7.0
Timeline
- 2026-08-21: disclosed