CVE-2026-59323 Overview
CVE-2026-59323 is a denial of service vulnerability in Micrometer Tracing when configured with the Brave bridge and W3C baggage propagation. The vulnerability stems from unbounded object allocation during extraction of incoming baggage headers. Remote attackers can send crafted HTTP requests containing oversized or numerous baggage entries to exhaust memory resources on the target application. The flaw is categorized as [CWE-770] Allocation of Resources Without Limits or Throttling. Exploitation requires no authentication and no user interaction, making internet-exposed services particularly exposed.
Critical Impact
Unauthenticated remote attackers can trigger memory exhaustion and degrade or crash Micrometer Tracing applications by submitting malicious W3C baggage headers.
Affected Products
- Micrometer Tracing 1.7.0
- Micrometer Tracing 1.6.0 through 1.6.6 and 1.5.0 through 1.5.12
- Micrometer Tracing 1.4.13 and earlier
Discovery Timeline
- 2026-08-21 - CVE-2026-59323 published to NVD
- 2026-08-27 - Last updated in NVD database
Technical Details for CVE-2026-59323
Vulnerability Analysis
Micrometer Tracing provides a vendor-neutral facade over distributed tracing libraries. Its Brave bridge integrates the Brave tracer with Micrometer's API. When W3C baggage propagation is enabled, the bridge parses the baggage HTTP header on incoming requests and materializes each key-value pair as an in-memory object. The parsing routine does not enforce a maximum count, key length, or value length on baggage entries. An attacker can therefore submit a single request containing thousands of oversized entries and force the application to allocate a disproportionate amount of heap memory.
Root Cause
The root cause is missing input validation during baggage extraction in the Brave bridge. The code path accepts arbitrary numbers of baggage items from untrusted callers and stores each in tracing context objects without applying resource limits. Repeated requests amplify the effect, driving the Java Virtual Machine (JVM) toward heap exhaustion and long garbage collection pauses.
Attack Vector
The vulnerability is network reachable. Any HTTP endpoint of an affected application that participates in W3C trace context propagation accepts the malicious baggage header. Attackers do not need credentials, session tokens, or prior interaction with the target. Sustained request volume produces a denial of service condition affecting availability, though confidentiality and integrity remain intact.
See the Spring Security Advisory CVE-2026-59323 for technical details on the affected code paths and remediation.
Detection Methods for CVE-2026-59323
Indicators of Compromise
- Incoming HTTP requests containing unusually large baggage headers or headers with hundreds of comma-separated key-value pairs.
- Java heap usage spikes and prolonged garbage collection pauses in services using Micrometer Tracing with Brave and W3C propagation.
- OutOfMemoryError exceptions correlated with tracing-related stack frames in application logs.
Detection Strategies
- Inspect web application firewall (WAF) and reverse proxy logs for baggage header values exceeding a conservative byte threshold, such as 8 KB.
- Correlate JVM memory metrics with request-rate spikes to identify allocation-driven availability incidents.
- Add application-level logging that records baggage entry counts and rejects requests exceeding safe limits.
Monitoring Recommendations
- Alert on rapid growth in heap occupancy and GC pause duration for services running affected Micrometer Tracing versions.
- Track request-size distributions at ingress and flag statistical outliers targeting tracing-enabled endpoints.
- Monitor upstream services for cascading timeouts that indicate a downstream tracing consumer is under memory pressure.
How to Mitigate CVE-2026-59323
Immediate Actions Required
- Inventory applications that depend on io.micrometer:micrometer-tracing-bridge-brave and confirm whether W3C baggage propagation is enabled.
- Upgrade Micrometer Tracing to a fixed release line as directed in the Spring Security Advisory CVE-2026-59323.
- Enforce ingress-level size limits on the baggage header at load balancers, API gateways, or reverse proxies until patches are deployed.
Patch Information
Upgrade to a patched Micrometer Tracing release beyond the affected version lines: 1.7.0, 1.6.0 through 1.6.6, 1.5.0 through 1.5.12, and 1.4.13 and earlier. Consult the Spring Security Advisory CVE-2026-59323 for the exact fixed versions and upgrade guidance. After upgrading, restart affected JVM processes to load the corrected baggage extraction logic.
Workarounds
- Disable W3C baggage propagation in the Brave bridge if tracing baggage is not required by downstream services.
- Restrict the baggage header at the perimeter using a WAF rule that caps total header size and rejects requests with excessive comma-delimited entries.
- Apply per-client rate limiting to tracing-enabled endpoints to reduce amplification potential from a single source.
Disclaimer: This content was generated using AI. While we strive for accuracy, please verify critical information with official sources.
