Description

In Micrometer, it is possible for a user to provide specially crafted HTTP requests that may cause a denial-of-service (DoS) condition.

Specifically, an application is vulnerable when all of the following are true:

• the application uses a vulnerable version of io.micrometer:micrometer-core, micrometer-jetty11, or micrometer-jetty12
• one or more of the HTTP server instrumentations from these artifacts are configured and metrics are recorded through the instrumentation

Affected Products and Versions

micrometer-core:

• 1.16.0 - 1.16.5
• 1.15.0 - 1.15.11
• 1.14.0 - 1.14.15
• 1.13.0 - 1.13.18
• 1.9.0 - 1.9.17

micrometer-jetty11:

• 1.16.0 - 1.16.5
• 1.15.0 - 1.15.11
• 1.14.0 - 1.14.15
• 1.13.0 - 1.13.18

micrometer-jetty12:

• 1.16.0 - 1.16.5
• 1.15.0 - 1.15.11
• 1.14.0 - 1.14.15
• 1.13.0 - 1.13.18

Versions that are no longer supported are also affected.

Mitigation

Users of affected versions should upgrade to the corresponding fixed version.

No further mitigation steps are necessary.

Credit

The issue was identified and responsibly reported by Yu Bao (@August829) - [email protected] – who works for paypal.com.

References

• https://nvd.nist.gov/vuln-metrics/cvss/v3-calculator?vector=AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H&version=3.1

History

• 2026-06-08: Initial vulnerability report published.