Description

In Micrometer, it is possible for a user to provide specially crafted gRPC requests that may cause a denial-of-service (DoS) condition.

Specifically, an application is vulnerable when all of the following are true:

• the application uses a vulnerable version of io.micrometer:micrometer-core
• an ObservationRegistry is configured in the application and it records observations
• DefaultMeterObservationHandler is configured to output metrics from Observations or the user has a custom ObservationHandler that outputs metrics similarly to DefaultMeterObservationHandler
• the application uses ObservationGrpcServerInterceptor to instrument its gRPC server

Affected Products and Versions

Micrometer:

• 1.16.0 - 1.16.5
• 1.15.0 - 1.15.11

Older versions than 1.15.0 are not affected.

Mitigation

Users of affected versions should upgrade to the corresponding fixed version.

No further mitigation steps are necessary.

Credit

The issue was identified and responsibly reported by Yu Bao (@August829) - [email protected] – who works for paypal.com.

References

• https://nvd.nist.gov/vuln-metrics/cvss/v3-calculator?vector=AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H&version=3.1

History

• 2026-06-08: Initial vulnerability report published.