Memory Leak Vulnerability in Apache HttpAsyncClient by Spring

CVE-2026-59295

What is CVE-2026-59295?

The Apache HttpAsyncClient, when utilized in conjunction with the MicrometerHttpClientInterceptor, exhibits a significant vulnerability that can lead to unbounded memory leaks. This occurs when asynchronous requests fail—such as in scenarios involving connection resets or timeouts—causing the system to retain state information in memory indefinitely. Continuous failures can result in heap exhaustion, potentially leading to OutOfMemoryError crashes that disrupt application performance and stability. For more information on this issue, refer to the Spring Security Advisory and related GitHub advisory.

References