CVE-2026-59295: Micrometer HTTP Client DoS Vulnerability

CVE-2026-59295 Overview

CVE-2026-59295 is a denial-of-service vulnerability affecting Micrometer, the observability instrumentation library commonly used with Spring applications. Outbound HTTP requests issued through a Micrometer-instrumented client trigger an unbounded memory leak. Sustained outbound request traffic exhausts heap memory and forces the affected Java Virtual Machine (JVM) into a denial-of-service state. The flaw impacts multiple release branches of Micrometer, including 1.17.0, 1.16.0 through 1.16.6, 1.15.0 through 1.15.12, 1.14.0 through 1.14.16, and all 1.9.18 and earlier releases.

Critical Impact
Applications making outbound HTTP calls with Micrometer instrumentation can be driven into an out-of-memory state, disrupting service availability.

Affected Products

Micrometer 1.17.0
Micrometer 1.16.0 through 1.16.6, 1.15.0 through 1.15.12, and 1.14.0 through 1.14.16
Micrometer 1.9.18 and earlier

Discovery Timeline

2026-08-24 - CVE-2026-59295 published to the National Vulnerability Database (NVD)
2026-08-27 - CVE-2026-59295 last updated in NVD

Technical Details for CVE-2026-59295

Vulnerability Analysis

Micrometer records metrics, tags, and meter registrations for each outbound HTTP request issued by an instrumented client. When the instrumentation retains meter or tag references without bounding cardinality, memory grows without limit. Each request adds to internal maps and registries that the garbage collector cannot reclaim.

Attacker-controlled input flowing into URI templates, headers, or tag values amplifies the leak because every distinct value creates a new meter. Over time the JVM heap fills, garbage collection thrashes, and the application stops serving traffic. The advisory classifies the outcome as a denial-of-service condition with no impact on confidentiality or integrity.

Root Cause

The root cause is unbounded retention of per-request instrumentation state within Micrometer-instrumented HTTP client code paths. Meter identifiers and tag combinations accumulate in memory rather than being aged out or capped. This is a memory leak that behaves as an algorithmic resource-exhaustion flaw under sustained outbound HTTP traffic.

Attack Vector

Exploitation requires the ability to influence outbound HTTP request attributes that Micrometer converts into meter tags. In practical deployments this includes downstream URLs, path variables, or header values driven by upstream user input. Repeated requests with high-cardinality values inflate the retained meter set until heap exhaustion produces an OutOfMemoryError. No authentication or user interaction is required for exploitation across a network path, but successful triggering depends on how the target application uses the instrumented client.

Refer to the Spring Security Advisory CVE-2026-59295 for the vendor's technical description.

Detection Methods for CVE-2026-59295

Indicators of Compromise

Steadily increasing JVM old-generation heap usage in services that issue outbound HTTP calls through Micrometer.
Rising jvm.gc.pause durations and frequency preceding application unresponsiveness.
java.lang.OutOfMemoryError: Java heap space events in application logs tied to HTTP client threads.
Rapid growth in the number of unique meter names or tag combinations exported to the metrics backend.

Detection Strategies

Inventory application dependencies for io.micrometer:micrometer-core versions matching the affected ranges.
Correlate heap growth with outbound HTTP request volume and downstream URI cardinality in metrics dashboards.
Enable heap dump on out-of-memory with -XX:+HeapDumpOnOutOfMemoryError and inspect retained sets for Micrometer meter registries.

Monitoring Recommendations

Alert on sustained heap growth trends over rolling windows rather than only on absolute thresholds.
Track meter cardinality per registry and alert when unique tag values exceed a defined ceiling.
Monitor downstream HTTP client latency and error rates for early signs of GC-induced degradation.

How to Mitigate CVE-2026-59295

Immediate Actions Required

Identify all services using Micrometer versions in the affected ranges and prioritize those with high outbound HTTP volume.
Upgrade Micrometer to a fixed release as documented in the Spring Security Advisory CVE-2026-59295.
Restart long-running JVMs after upgrading to release memory retained by the leaked meter state.

Patch Information

Refer to the Spring Security Advisory CVE-2026-59295 for the fixed Micrometer versions and upgrade guidance. Apply the patched release across all branches (1.14.x, 1.15.x, 1.16.x, 1.17.x) matching the environment.

Workarounds

Restrict URI tag cardinality by using URI templates rather than raw paths in Micrometer HTTP client instrumentation.
Configure MeterFilter.maximumAllowableTags or MeterFilter.deny rules to cap the number of unique tag values.
Disable Micrometer HTTP client instrumentation on services that cannot be upgraded immediately, if metrics loss is acceptable.
Set JVM heap limits and configure automated restarts to reduce blast radius until patching completes.

bash

# Example MeterFilter configuration to cap URI tag cardinality
# Applied via a MeterRegistryCustomizer bean in a Spring Boot application
#
# @Bean
# MeterRegistryCustomizer<MeterRegistry> capUriTags() {
#   return registry -> registry.config()
#     .meterFilter(MeterFilter.maximumAllowableTags(
#         "http.client.requests", "uri", 100, MeterFilter.deny()));
# }