CVE-2026-40984: Micrometer DoS Vulnerability

CVE-2026-40984 Overview

CVE-2026-40984 is a denial-of-service vulnerability in Micrometer, the application metrics facade used by Spring Boot and other JVM applications. Attackers can send specially crafted HTTP requests that cause resource exhaustion in vulnerable Micrometer components, rendering the target application unresponsive. The flaw maps to [CWE-400] Uncontrolled Resource Consumption and is exploitable over the network without authentication or user interaction.

The vulnerability affects micrometer-core, micrometer-jetty11, and micrometer-jetty12 across multiple release lines. Spring published an advisory through its security channel, indicating broad downstream impact on Spring-based services that expose HTTP endpoints instrumented by Micrometer.

Critical Impact
Unauthenticated remote attackers can trigger a denial-of-service condition against any internet-facing Spring or Jetty service using a vulnerable Micrometer version.

Affected Products

micrometer-core versions 1.9.0–1.9.17, 1.13.0–1.13.18, 1.14.0–1.14.15, 1.15.0–1.15.11, and 1.16.0–1.16.5
micrometer-jetty11 versions 1.13.0–1.13.18, 1.14.0–1.14.15, 1.15.0–1.15.11, and 1.16.0–1.16.5
micrometer-jetty12 versions 1.13.0–1.13.18, 1.14.0–1.14.15, 1.15.0–1.15.11, and 1.16.0–1.16.5

Discovery Timeline

2026-06-09 - CVE-2026-40984 published to NVD
2026-06-09 - Last updated in NVD database

Technical Details for CVE-2026-40984

Vulnerability Analysis

Micrometer instruments HTTP server activity by tagging metrics with request attributes such as method, status, and URI. The vulnerable code paths in micrometer-core and the Jetty integration modules process attacker-controlled fields from incoming HTTP requests when generating those tags. A crafted request triggers uncontrolled resource consumption inside the metrics pipeline, exhausting CPU or memory on the target JVM.

Because Micrometer runs inline with request handling, the impact propagates to the host application. Worker threads stall, response latency spikes, and the service stops accepting new connections. The condition affects availability only, with no impact on confidentiality or integrity, which is consistent with the [CWE-400] classification.

Root Cause

The root cause is missing or insufficient bounds enforcement on request-derived data used in Micrometer's HTTP metrics tagging. When the input cardinality or size exceeds expected limits, the affected code allocates excessive resources rather than rejecting or normalizing the input. Spring's advisory tracks the fix in the patched Micrometer releases.

Attack Vector

Exploitation requires only network reach to an HTTP endpoint served by an application that uses a vulnerable Micrometer release. The attacker sends one or more crafted requests, with no authentication and no user interaction. Repeated requests amplify the effect and can sustain a denial-of-service state until the JVM is restarted. The vulnerability manifests through standard HTTP traffic, so it is exploitable through any reverse proxy, load balancer, or CDN that forwards the malicious request to the origin.

No public proof-of-concept exploit is referenced in the advisory at this time. Technical details are described in the Spring Security CVE-2026-40984 advisory.

Detection Methods for CVE-2026-40984

Indicators of Compromise

Sudden spikes in JVM heap usage, GC pause time, or thread count on services that expose Micrometer-instrumented HTTP endpoints.
HTTP requests containing unusually long, malformed, or high-cardinality values in URI, method, or header fields that feed Micrometer tags.
Repeated 5xx responses or connection timeouts from Spring Boot or Jetty services without a corresponding deployment change.

Detection Strategies

Inventory all JVM applications and confirm the micrometer-core, micrometer-jetty11, and micrometer-jetty12 versions in use against the affected ranges.
Inspect web access logs and WAF telemetry for anomalous request patterns targeting /actuator, /metrics, or other instrumented endpoints.
Correlate application performance management (APM) alerts on latency and thread pool saturation with upstream request sources.

Monitoring Recommendations

Alert on sustained increases in http.server.requests tag cardinality, which can indicate attacker-controlled input feeding metric labels.
Monitor Jetty thread pool exhaustion and queued request counts for services running micrometer-jetty11 or micrometer-jetty12.
Track per-source request rates at the edge and rate-limit clients generating disproportionate error or timeout volumes.

How to Mitigate CVE-2026-40984

Immediate Actions Required

Upgrade micrometer-core, micrometer-jetty11, and micrometer-jetty12 to the fixed releases noted in the Spring Security advisory.
Audit transitive dependencies in Spring Boot, Spring Cloud, and standalone Jetty services to confirm the patched Micrometer version is resolved at build time.
Restrict exposure of management and metrics endpoints to trusted networks until patching is complete.

Patch Information

Pivotal/Spring published fixed Micrometer releases addressing CVE-2026-40984. Consult the Spring Security CVE-2026-40984 advisory for the exact fixed versions and upgrade guidance for each supported release line (1.9.x, 1.13.x, 1.14.x, 1.15.x, and 1.16.x).

Workarounds

Place a WAF or reverse proxy in front of affected services and enforce strict limits on request URI length, header size, and method values.
Apply per-client rate limiting and connection caps at the edge to blunt repeated DoS attempts.
Disable or restrict Micrometer HTTP server instrumentation where feasible until the upgrade is deployed.

bash

# Maven dependency override to pin a fixed Micrometer version
# Replace <FIXED_VERSION> with the patched release from the Spring advisory
mvn dependency:tree -Dincludes=io.micrometer
mvn versions:set-property -Dproperty=micrometer.version -DnewVersion=<FIXED_VERSION>