Denial-of-Service Vulnerability in Micrometer Products by Pivotal
CVE-2026-40984

7.5HIGH

Key Information:

Vendor

Spring

Vendor
CVE Published:
9 June 2026

What is CVE-2026-40984?

A vulnerability within Micrometer allows an attacker to craft specific HTTP requests that could lead to a denial-of-service (DoS) condition, impacting the availability of the application. This may result in the application becoming unresponsive or crashing, hindering its ability to serve legitimate user requests. It’s crucial for organizations using affected versions to implement mitigations to safeguard their systems from potential exploitation.

Affected Version(s)

Micrometer 1.16.0 < 1.16.5.1

Micrometer 1.15.0 < 1.15.11.1

Micrometer 1.14.0 < 1.14.16

References

CVSS V3.1

Score:
7.5
Severity:
HIGH
Confidentiality:
None
Integrity:
None
Availability:
None
Attack Vector:
Network
Attack Complexity:
Low
Privileges Required:
None
User Interaction:
None
Scope:
Unchanged

Timeline

  • Vulnerability published

  • Vulnerability Reserved

.