CVE-2026-40983
Description
Micrometer versions 1.15.0-1.15.11 and 1.16.0-1.16.5 are vulnerable to a denial-of-service via crafted gRPC requests.
AI Insight
LLM-synthesized narrative grounded in this CVE's description and references.
Micrometer versions 1.15.0-1.15.11 and 1.16.0-1.16.5 are vulnerable to a denial-of-service via crafted gRPC requests.
Vulnerability
In Micrometer, applications using specific versions of io.micrometer:micrometer-core (1.16.0 through 1.16.5 and 1.15.0 through 1.15.11) are vulnerable if an ObservationRegistry is configured, DefaultMeterObservationHandler is used for metrics output, and ObservationGrpcServerInterceptor is employed to instrument the gRPC server. Specially crafted gRPC requests can trigger a denial-of-service condition [1].
Exploitation
An unauthenticated attacker with network access can send specially crafted gRPC requests to an instrumented gRPC server. If the server is configured with the vulnerable Micrometer versions and specific observation handlers, these requests can lead to a denial-of-service condition. No user interaction is required [1].
Impact
Successful exploitation of this vulnerability can lead to a denial-of-service (DoS) condition, making the gRPC server unavailable to legitimate users. This impacts the availability of the application's services [1].
Mitigation
Users should upgrade to Micrometer version 1.16.6 or 1.15.12. Older versions prior to 1.15.0 are not affected. No further mitigation steps are necessary beyond upgrading [1].
AI Insight generated on Jun 9, 2026. Synthesized from this CVE's description and the cited reference URLs; citations are validated against the source bundle.
Affected products
1- Range: 1.16.0 - 1.16.5, 1.15.0 - 1.15.11
Patches
0No patches discovered yet.
Vulnerability mechanics
No source-code context for this CVE — mechanics is only generated when we can read the actual fix diff. Without that, the four sections (root cause, attack vector, affected code, fix) would be speculation rather than analysis.
References
1News mentions
0No linked articles in our index yet.