CVE-2026-40983: Micrometer gRPC DoS Vulnerability

CVE-2026-40983 Overview

CVE-2026-40983 is a denial-of-service vulnerability affecting Micrometer, the application observability library widely used across Spring and Java ecosystems. The flaw allows a remote, unauthenticated attacker to send specially crafted gRPC requests that exhaust resources and disrupt service availability. The vulnerability is tracked under [CWE-400] (Uncontrolled Resource Consumption) and impacts Micrometer versions 1.16.0 through 1.16.5 and 1.15.0 through 1.15.11. No authentication or user interaction is required, and the attack is exploitable over the network.

Critical Impact
Remote attackers can trigger denial-of-service conditions in Micrometer-instrumented gRPC services with no authentication, potentially disrupting application telemetry pipelines and dependent production workloads.

Affected Products

Micrometer 1.16.0 through 1.16.5
Micrometer 1.15.0 through 1.15.11
Applications embedding Micrometer gRPC instrumentation in the above ranges

Discovery Timeline

2026-06-09 - CVE-2026-40983 published to the National Vulnerability Database
2026-06-09 - Last updated in NVD database

Technical Details for CVE-2026-40983

Vulnerability Analysis

Micrometer provides instrumentation for gRPC client and server interactions, recording metrics such as request counts, latencies, and status codes. The vulnerability resides in how this instrumentation processes gRPC request metadata. An attacker can craft gRPC requests whose content triggers excessive resource consumption within the metrics collection path, leading to a denial-of-service condition on the host process.

Because Micrometer instrumentation typically runs inline with normal request handling, exhaustion within the metrics layer cascades into the application itself. Services that rely on Micrometer for telemetry — common in Spring Boot, Spring Cloud, and reactive microservice architectures — can become unresponsive under sustained attack traffic.

Root Cause

The issue is an uncontrolled resource consumption flaw [CWE-400] in the gRPC request handling path inside Micrometer. Specially shaped input is processed without sufficient bounds, allowing an attacker to drive CPU or memory usage beyond what the process can sustain. The Spring Security Advisory documents the affected version ranges and fixed releases.

Attack Vector

The attack vector is network-based and requires no privileges or user interaction. An attacker who can reach a gRPC endpoint instrumented with a vulnerable Micrometer version sends crafted requests that the instrumentation processes. Because gRPC services are frequently exposed across service meshes and internal networks, lateral exploitation by a compromised workload is also feasible. The vulnerability does not affect confidentiality or integrity — only availability.

No verified public proof-of-concept code is available at this time. Refer to the Spring Security Advisory for technical details from the maintainers.

Detection Methods for CVE-2026-40983

Indicators of Compromise

Sudden CPU or heap saturation in Java processes coinciding with bursts of inbound gRPC traffic
Unusual growth in Micrometer metric registry size or meter creation rate
Repeated gRPC requests from a single source containing anomalous metadata or method names
Application unresponsiveness or OOM events on services exposing gRPC endpoints

Detection Strategies

Inventory all Java applications and identify Micrometer dependency versions, flagging any in the 1.15.0-1.15.11 or 1.16.0-1.16.5 ranges
Correlate gRPC request rates against JVM resource metrics to identify amplification patterns indicative of exploitation
Inspect access logs and service mesh telemetry for malformed or atypical gRPC request structures

Monitoring Recommendations

Alert on sustained JVM CPU usage above baseline thresholds on gRPC service hosts
Monitor garbage collection pause times and heap utilization for affected services
Track gRPC request error rates, particularly UNAVAILABLE and RESOURCE_EXHAUSTED status codes
Enable rate limiting at the ingress and capture source IPs generating outsized traffic to gRPC endpoints

How to Mitigate CVE-2026-40983

Immediate Actions Required

Upgrade Micrometer to a fixed release as identified in the Spring Security Advisory
Audit dependency trees with mvn dependency:tree or gradle dependencies to confirm no transitive vulnerable versions remain
Restrict gRPC endpoint exposure to trusted network segments where feasible
Enable rate limiting and request size limits on gRPC ingress points

Patch Information

Upgrade Micrometer to a patched version outside the affected ranges. Consult the Spring Security Advisory for the specific fixed versions that address CVE-2026-40983. Applications relying on Spring Boot should rebuild against the patched Micrometer release and redeploy.

Workarounds

Deploy a gRPC-aware proxy or service mesh policy to enforce request rate and concurrency limits in front of vulnerable services
Disable Micrometer gRPC instrumentation on internet-facing services until patches are applied
Apply network ACLs to restrict gRPC access to authenticated peers only

bash

# Maven dependency override example to enforce a patched Micrometer version
mvn dependency:tree -Dincludes=io.micrometer:micrometer-core

# Gradle: pin Micrometer to a fixed version in build.gradle
# implementation('io.micrometer:micrometer-core') {
#     version { strictly '<fixed-version>' }
# }