CVE-2026-40984

Fixed in a distro release EPSS <1%CVSS 7.5

In Micrometer, it is possible for a user to provide specially crafted HTTP requests that may cause a denial-of-service (DoS) condition. Affected versions: micrometer-core 1.16.0 through 1.16.5; 1.15.0 through 1.15.11; 1.14.0 through 1.14.15; 1.13.0 through 1.13.18; 1.9.0 through 1.9.17. micrometer-jetty11 1.16.0 through 1.16.5; 1.15.0 through 1.15.11; 1.14.0 through 1.14.15; 1.13.0 through 1.13.18. micrometer-jetty12 1.16.0 through 1.16.5; 1.15.0 through 1.15.11; 1.14.0 through 1.14.15; 1.13.0 through 1.13.18.

Published 2026-06-09 · CVE record · OSV

Products: Spring Micrometer, Red Hat AMQ Broker 7.13.6, Red Hat AMQ Broker 7.14.1, Red Hat build of Apache Camel 4.18.1.P1 for Spring Boot 3.5.16, Red Hat Build of Apache Camel 4.18 for Quarkus 3.33, Red Hat build of Keycloak 26.6, Red Hat build of Keycloak 26.6.5, Red Hat Data Grid 8.6.2, Red Hat Streams for Apache Kafka 3.2.1, Red Hat OpenShift Dev Spaces 3.30, Red Hat AMQ Clients, Red Hat build of Apache Camel 4 for Quarkus 3, Red Hat build of Apache Camel - HawtIO 4, Red Hat build of Apicurio Registry 3, Red Hat build of Debezium 3, Red Hat build of OptaPlanner 8, Red Hat Fuse 7, Red Hat JBoss Enterprise Application Platform Expansion Pack, Red Hat OpenShift AI (RHOAI), Red Hat OpenShift Dev Spaces, Red Hat Process Automation 7, Red Hat streams for Apache Kafka 2

Fixed upstream

Distro releases