CVE-2026-59295: Micrometer instrumentation of Apache HttpAsyncClient DoS vulnerability
It is possible for outbound HTTP requests using a Micrometer-instrumented client to cause a denial-of-service (DoS) condition due to an unbounded memory leak. Micrometer 1.17.0 Micrometer 1.16.0 - 1.16.6 Micrometer 1.15.0 - 1.15.12 Micrometer 1.14.0 - 1.14.16 Micrometer 1.9.18 and earlier
Affected Software
Event History
Frequently Asked Questions
Which deployments are exposed to this issue?
Deployments using Apache HttpAsyncClient 4.x or 5.x through MicrometerHttpClientInterceptor are exposed when asynchronous requests can fail before a response is received. Examples include connection resets and timeouts.
What conditions are required for exploitation?
An attacker or network condition must cause sustained asynchronous request failures before responses are received. The issue has no required privileges or user interaction, but exploitation is rated high complexity.
What happens if the issue is triggered repeatedly?
Tracking state for failed requests remains in memory indefinitely. Sustained failures can exhaust the heap and cause an OutOfMemoryError crash.