High severity7.5NVD Advisory· Published Jun 9, 2026· Updated Sep 14, 2026
CVE-2026-40984
CVE-2026-40984
Description
In Micrometer, it is possible for a user to provide specially crafted HTTP requests that may cause a denial-of-service (DoS) condition.
Affected versions: micrometer-core 1.16.0 through 1.16.5; 1.15.0 through 1.15.11; 1.14.0 through 1.14.15; 1.13.0 through 1.13.18; 1.9.0 through 1.9.17. micrometer-jetty11 1.16.0 through 1.16.5; 1.15.0 through 1.15.11; 1.14.0 through 1.14.15; 1.13.0 through 1.13.18. micrometer-jetty12 1.16.0 through 1.16.5; 1.15.0 through 1.15.11; 1.14.0 through 1.14.15; 1.13.0 through 1.13.18.
AI Insight
LLM-synthesized narrative grounded in this CVE's description and references.
Affected packages
Versions sourced from the GitHub Security Advisory.
| Package | Affected versions | Patched versions |
|---|---|---|
io.micrometer:micrometer-coreMaven | >= 1.16.0, < 1.16.6 | 1.16.6 |
io.micrometer:micrometer-coreMaven | >= 1.15.0, < 1.15.12 | 1.15.12 |
io.micrometer:micrometer-coreMaven | >= 1.14.0, <= 1.14.14 | — |
io.micrometer:micrometer-coreMaven | >= 1.10.0, <= 1.13.15 | — |
io.micrometer:micrometer-coreMaven | <= 1.9.17 | — |
io.micrometer:micrometer-jetty12Maven | >= 1.16.0, < 1.16.6 | 1.16.6 |
io.micrometer:micrometer-jetty12Maven | >= 1.15.0, < 1.15.12 | 1.15.12 |
io.micrometer:micrometer-jetty12Maven | >= 1.14.0, <= 1.14.14 | — |
io.micrometer:micrometer-jetty12Maven | <= 1.13.15 | — |
io.micrometer:micrometer-jetty11Maven | >= 1.16.0, < 1.16.6 | 1.16.6 |
io.micrometer:micrometer-jetty11Maven | >= 1.15.0, < 1.15.12 | 1.15.12 |
io.micrometer:micrometer-jetty11Maven | >= 1.14.0, <= 1.14.14 | — |
io.micrometer:micrometer-jetty11Maven | <= 1.13.15 | — |
Affected products
65- osv-coords64 versionspkg:apk/chainguard/infinispan-16.2pkg:apk/chainguard/apache-nifi-2.11pkg:apk/chainguard/apicurio-registry-3-operatorpkg:apk/chainguard/hono-service-command-routerpkg:apk/chainguard/airbyte-server-fipspkg:apk/chainguard/apicurio-registry-fipspkg:apk/chainguard/dependency-trackpkg:apk/chainguard/dependency-track-apiserver-4pkg:apk/chainguard/request-9047-keycloak-fips-26.6-iamguarded-fipspkg:apk/chainguard/request-9047-keycloak-fips-26.6-operatorpkg:apk/wolfi/apicurio-registrypkg:apk/chainguard/ontop-fipspkg:apk/chainguard/request-9047-keycloak-fips-26.6pkg:apk/chainguard/knative-kafka-broker-1.23-receiver-loompkg:apk/chainguard/camunda-zeebe-8.6pkg:apk/chainguard/hono-adapter-mqttpkg:apk/chainguard/keycloak-26.6-operatorpkg:apk/chainguard/knative-kafka-broker-fips-1.22-dispatcher-loompkg:apk/wolfi/infinispan-16.1pkg:apk/chainguard/knative-kafka-broker-1.23-dispatcher-loompkg:apk/chainguard/keycloak-26.7pkg:apk/chainguard/keycloak-fips-26.6pkg:apk/chainguard/keycloak-fips-26.6-operatorpkg:apk/chainguard/knative-kafka-broker-fips-1.22-receiver-loompkg:apk/chainguard/keycloak-26.6-iamguarded-compatpkg:apk/chainguard/keycloak-fips-26.6-iamguarded-fipspkg:apk/chainguard/infinispan-15.2pkg:apk/chainguard/hono-service-device-registry-jdbcpkg:apk/chainguard/keycloak-fips-26.7-iamguarded-fipspkg:apk/chainguard/knative-kafka-broker-fips-1.23-dispatcher-loompkg:apk/chainguard/dependency-track-bundledpkg:apk/chainguard/infinispan-15.1pkg:apk/chainguard/keycloak-26.6pkg:apk/chainguard/nacospkg:apk/chainguard/nacos-dockerpkg:apk/wolfi/dependency-trackpkg:apk/wolfi/infinispan-16.2pkg:apk/wolfi/keycloak-26.6pkg:apk/wolfi/zipkinpkg:apk/wolfi/zipkin-slimpkg:apk/chainguard/kafka-bridge-fipspkg:apk/chainguard/infinispan-16.1pkg:apk/chainguard/keycloak-fips-26.7pkg:apk/chainguard/knative-kafka-broker-1.22-receiver-loompkg:apk/chainguard/request-9047-keycloak-fips-26.5-iamguarded-fipspkg:apk/chainguard/request-9047-keycloak-fips-26.5-operatorpkg:apk/wolfi/dependency-track-bundledpkg:apk/chainguard/keycloak-26.7-iamguarded-compatpkg:apk/chainguard/ontoppkg:apk/chainguard/request-9047-keycloak-fips-26.4pkg:apk/chainguard/request-9047-keycloak-fips-26.5pkg:apk/chainguard/airbyte-serverpkg:apk/wolfi/keycloak-26.6-operatorpkg:apk/chainguard/knative-kafka-broker-fips-1.23-receiver-loompkg:apk/chainguard/apicurio-registrypkg:apk/chainguard/zipkin-slimpkg:apk/chainguard/hono-service-authpkg:apk/chainguard/request-9047-keycloak-fips-26.4-operatorpkg:apk/chainguard/knative-kafka-broker-1.22-dispatcher-loompkg:apk/wolfi/keycloak-26.6-iamguarded-compatpkg:apk/chainguard/apicurio-registry-3-operator-fipspkg:apk/chainguard/kafka-bridgepkg:apk/chainguard/keycloak-fips-26.7-operatorpkg:apk/chainguard/zipkin
< 16.2.2-r1+ 63 more
- (no CPE)range: < 16.2.2-r1
- (no CPE)range: < 2.11.0-r1
- (no CPE)range: < 3.3.1-r2
- (no CPE)range: < 2.7.0-r39
- (no CPE)range: < 2.0.0-r11
- (no CPE)range: < 3.3.0-r11
- (no CPE)range: < 4.14.3-r1
- (no CPE)range: < 4.14.3-r2
- (no CPE)range: < 26.6.4-r14
- (no CPE)range: < 26.6.4-r14
- (no CPE)range: < 3.3.1-r2
- (no CPE)range: < 5.5.0-r16
- (no CPE)range: < 26.6.4-r14
- (no CPE)range: < 1.23.0-r5
- (no CPE)range: < 8.6.39-r7
- (no CPE)range: < 2.7.0-r39
- (no CPE)range: < 26.6.6-r0
- (no CPE)range: < 1.22.3-r5
- (no CPE)range: < 16.1.4-r9
- (no CPE)range: < 1.23.0-r5
- (no CPE)range: < 26.7.1-r1
- (no CPE)range: < 26.6.6-r0
- (no CPE)range: < 26.6.6-r0
- (no CPE)range: < 1.22.3-r5
- (no CPE)range: < 26.6.6-r0
- (no CPE)range: < 26.6.6-r0
- (no CPE)range: < 15.2.6-r27
- (no CPE)range: < 2.7.0-r39
- (no CPE)range: < 26.7.1-r1
- (no CPE)range: < 1.23.0-r3
- (no CPE)range: < 4.14.3-r1
- (no CPE)range: < 15.1.7-r28
- (no CPE)range: < 26.6.6-r0
- (no CPE)range: < 3.2.3-r6
- (no CPE)range: < 3.2.3-r4
- (no CPE)range: < 4.14.3-r1
- (no CPE)range: < 16.2.2-r1
- (no CPE)range: < 26.6.6-r0
- (no CPE)range: < 3.6.1-r19
- (no CPE)range: < 3.6.1-r19
- (no CPE)range: < 1.1.0-r0
- (no CPE)range: < 16.1.4-r9
- (no CPE)range: < 26.7.1-r1
- (no CPE)range: < 1.22.3-r9
- (no CPE)range: < 26.5.7-r24
- (no CPE)range: < 26.5.7-r24
- (no CPE)range: < 4.14.3-r1
- (no CPE)range: < 26.7.1-r1
- (no CPE)range: < 5.5.0-r22
- (no CPE)range: < 26.4.7-r34
- (no CPE)range: < 26.5.7-r24
- (no CPE)range: < 2.0.0-r9
- (no CPE)range: < 26.6.6-r0
- (no CPE)range: < 1.23.0-r3
- (no CPE)range: < 3.3.1-r2
- (no CPE)range: < 3.6.1-r19
- (no CPE)range: < 2.7.0-r39
- (no CPE)range: < 26.4.7-r34
- (no CPE)range: < 1.22.3-r9
- (no CPE)range: < 26.6.6-r0
- (no CPE)range: < 3.3.0-r11
- (no CPE)range: < 1.1.0-r0
- (no CPE)range: < 26.7.1-r1
- (no CPE)range: < 3.6.1-r19
- Range: 1.16.0 through 1.16.5; 1.15.0 through 1.15.11; 1.14.0 through 1.14.15; 1.13.0 through 1.13.18; 1.9.0 through 1.9.17
Patches
Vulnerability mechanics
References
16- github.com/advisories/GHSA-g3pr-3p32-fp23ghsaADVISORY
- nvd.nist.gov/vuln/detail/CVE-2026-40984ghsaADVISORY
- access.redhat.com/errata/RHSA-2026:36839nvdWEB
- access.redhat.com/errata/RHSA-2026:37390nvdWEB
- access.redhat.com/errata/RHSA-2026:41951nvdWEB
- access.redhat.com/errata/RHSA-2026:50848nvdWEB
- access.redhat.com/errata/RHSA-2026:50849nvdWEB
- access.redhat.com/errata/RHSA-2026:54435nvdWEB
- access.redhat.com/errata/RHSA-2026:62260nvdWEB
- access.redhat.com/errata/RHSA-2026:66488nvdWEB
- access.redhat.com/errata/RHSA-2026:66545nvdWEB
- access.redhat.com/security/cve/CVE-2026-40984nvdWEB
- bugzilla.redhat.com/show_bug.cginvdWEB
- github.com/micrometer-metrics/micrometer/commit/36da131525228188a36779a28471a76c79213dd4ghsaWEB
- security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-40984.jsonnvdWEB
- spring.io/security/cve-2026-40984nvdWEB
News mentions
0No linked articles in our index yet.