CVE-2026-59295: Micrometer Instrumentation of Apache HttpAsyncClient Denial of Service Vulnerability
Micrometer-instrumented Apache HttpAsyncClient (4.x or 5.x) usage via MicrometerHttpClientInterceptor can leak memory unboundedly when asynchronous requests fail before receiving a response (e.g. connection resets or timeouts). Tracking state for these requests remains in memory indefinitely, and sustained failures lead to heap exhaustion and OutOfMemoryError crashes.
Affected Software
Event History
Frequently Asked Questions
Which deployments are exposed to this issue?
Deployments using Apache HttpAsyncClient 4.x or 5.x through MicrometerHttpClientInterceptor are exposed when asynchronous requests can fail before a response is received. Examples include connection resets and timeouts.
What conditions are required for exploitation?
An attacker or network condition must cause sustained asynchronous request failures before responses are received. The issue has no required privileges or user interaction, but exploitation is rated high complexity.
What happens if the issue is triggered repeatedly?
Tracking state for failed requests remains in memory indefinitely. Sustained failures can exhaust the heap and cause an OutOfMemoryError crash.