High severity7.5NVD Advisory· Published Jun 9, 2026· Updated Sep 2, 2026
CVE-2026-40984
CVE-2026-40984
Description
In Micrometer, it is possible for a user to provide specially crafted HTTP requests that may cause a denial-of-service (DoS) condition.
Affected versions: micrometer-core 1.16.0 through 1.16.5; 1.15.0 through 1.15.11; 1.14.0 through 1.14.15; 1.13.0 through 1.13.18; 1.9.0 through 1.9.17. micrometer-jetty11 1.16.0 through 1.16.5; 1.15.0 through 1.15.11; 1.14.0 through 1.14.15; 1.13.0 through 1.13.18. micrometer-jetty12 1.16.0 through 1.16.5; 1.15.0 through 1.15.11; 1.14.0 through 1.14.15; 1.13.0 through 1.13.18.
AI Insight
LLM-synthesized narrative grounded in this CVE's description and references.
Affected products
65- Range: 1.16.0 through 1.16.5; 1.15.0 through 1.15.11; 1.14.0 through 1.14.15; 1.13.0 through 1.13.18; 1.9.0 through 1.9.17
- osv-coords64 versionspkg:apk/chainguard/airbyte-serverpkg:apk/chainguard/airbyte-server-fipspkg:apk/chainguard/apache-nifi-2.11pkg:apk/chainguard/apicurio-registrypkg:apk/chainguard/apicurio-registry-3-operatorpkg:apk/chainguard/apicurio-registry-3-operator-fipspkg:apk/chainguard/apicurio-registry-fipspkg:apk/chainguard/camunda-zeebe-8.6pkg:apk/chainguard/dependency-trackpkg:apk/chainguard/dependency-track-apiserver-4pkg:apk/chainguard/dependency-track-bundledpkg:apk/chainguard/hono-adapter-mqttpkg:apk/chainguard/hono-service-authpkg:apk/chainguard/hono-service-command-routerpkg:apk/chainguard/hono-service-device-registry-jdbcpkg:apk/chainguard/infinispan-15.1pkg:apk/chainguard/infinispan-15.2pkg:apk/chainguard/infinispan-16.1pkg:apk/chainguard/infinispan-16.2pkg:apk/chainguard/kafka-bridgepkg:apk/chainguard/kafka-bridge-fipspkg:apk/chainguard/keycloak-26.6pkg:apk/chainguard/keycloak-26.6-iamguarded-compatpkg:apk/chainguard/keycloak-26.6-operatorpkg:apk/chainguard/keycloak-26.7pkg:apk/chainguard/keycloak-26.7-iamguarded-compatpkg:apk/chainguard/keycloak-fips-26.6pkg:apk/chainguard/keycloak-fips-26.6-iamguarded-fipspkg:apk/chainguard/keycloak-fips-26.6-operatorpkg:apk/chainguard/keycloak-fips-26.7pkg:apk/chainguard/keycloak-fips-26.7-iamguarded-fipspkg:apk/chainguard/keycloak-fips-26.7-operatorpkg:apk/chainguard/knative-kafka-broker-1.22-dispatcher-loompkg:apk/chainguard/knative-kafka-broker-1.22-receiver-loompkg:apk/chainguard/knative-kafka-broker-1.23-dispatcher-loompkg:apk/chainguard/knative-kafka-broker-1.23-receiver-loompkg:apk/chainguard/knative-kafka-broker-fips-1.22-dispatcher-loompkg:apk/chainguard/knative-kafka-broker-fips-1.22-receiver-loompkg:apk/chainguard/knative-kafka-broker-fips-1.23-dispatcher-loompkg:apk/chainguard/knative-kafka-broker-fips-1.23-receiver-loompkg:apk/chainguard/nacospkg:apk/chainguard/nacos-dockerpkg:apk/chainguard/ontoppkg:apk/chainguard/ontop-fipspkg:apk/chainguard/request-9047-keycloak-fips-26.4pkg:apk/chainguard/request-9047-keycloak-fips-26.4-operatorpkg:apk/chainguard/request-9047-keycloak-fips-26.5pkg:apk/chainguard/request-9047-keycloak-fips-26.5-iamguarded-fipspkg:apk/chainguard/request-9047-keycloak-fips-26.5-operatorpkg:apk/chainguard/request-9047-keycloak-fips-26.6pkg:apk/chainguard/request-9047-keycloak-fips-26.6-iamguarded-fipspkg:apk/chainguard/request-9047-keycloak-fips-26.6-operatorpkg:apk/chainguard/zipkinpkg:apk/chainguard/zipkin-slimpkg:apk/wolfi/apicurio-registrypkg:apk/wolfi/dependency-trackpkg:apk/wolfi/dependency-track-bundledpkg:apk/wolfi/infinispan-16.1pkg:apk/wolfi/infinispan-16.2pkg:apk/wolfi/keycloak-26.6pkg:apk/wolfi/keycloak-26.6-iamguarded-compatpkg:apk/wolfi/keycloak-26.6-operatorpkg:apk/wolfi/zipkinpkg:apk/wolfi/zipkin-slim
< 2.0.0-r9+ 63 more
- (no CPE)range: < 2.0.0-r9
- (no CPE)range: < 2.0.0-r11
- (no CPE)range: < 2.11.0-r1
- (no CPE)range: < 3.3.1-r2
- (no CPE)range: < 3.3.1-r2
- (no CPE)range: < 3.3.0-r11
- (no CPE)range: < 3.3.0-r11
- (no CPE)range: < 8.6.39-r7
- (no CPE)range: < 4.14.3-r1
- (no CPE)range: < 4.14.3-r2
- (no CPE)range: < 4.14.3-r1
- (no CPE)range: < 2.7.0-r39
- (no CPE)range: < 2.7.0-r39
- (no CPE)range: < 2.7.0-r39
- (no CPE)range: < 2.7.0-r39
- (no CPE)range: < 15.1.7-r28
- (no CPE)range: < 15.2.6-r27
- (no CPE)range: < 16.1.4-r9
- (no CPE)range: < 16.2.2-r1
- (no CPE)range: < 1.1.0-r0
- (no CPE)range: < 1.1.0-r0
- (no CPE)range: < 26.6.6-r0
- (no CPE)range: < 26.6.6-r0
- (no CPE)range: < 26.6.6-r0
- (no CPE)range: < 26.7.1-r1
- (no CPE)range: < 26.7.1-r1
- (no CPE)range: < 26.6.6-r0
- (no CPE)range: < 26.6.6-r0
- (no CPE)range: < 26.6.6-r0
- (no CPE)range: < 26.7.1-r1
- (no CPE)range: < 26.7.1-r1
- (no CPE)range: < 26.7.1-r1
- (no CPE)range: < 1.22.3-r9
- (no CPE)range: < 1.22.3-r9
- (no CPE)range: < 1.23.0-r5
- (no CPE)range: < 1.23.0-r5
- (no CPE)range: < 1.22.3-r5
- (no CPE)range: < 1.22.3-r5
- (no CPE)range: < 1.23.0-r3
- (no CPE)range: < 1.23.0-r3
- (no CPE)range: < 3.2.3-r6
- (no CPE)range: < 3.2.3-r4
- (no CPE)range: < 5.5.0-r22
- (no CPE)range: < 5.5.0-r16
- (no CPE)range: < 26.4.7-r34
- (no CPE)range: < 26.4.7-r34
- (no CPE)range: < 26.5.7-r24
- (no CPE)range: < 26.5.7-r24
- (no CPE)range: < 26.5.7-r24
- (no CPE)range: < 26.6.4-r14
- (no CPE)range: < 26.6.4-r14
- (no CPE)range: < 26.6.4-r14
- (no CPE)range: < 3.6.1-r19
- (no CPE)range: < 3.6.1-r19
- (no CPE)range: < 3.3.1-r2
- (no CPE)range: < 4.14.3-r1
- (no CPE)range: < 4.14.3-r1
- (no CPE)range: < 16.1.4-r9
- (no CPE)range: < 16.2.2-r1
- (no CPE)range: < 26.6.6-r0
- (no CPE)range: < 26.6.6-r0
- (no CPE)range: < 26.6.6-r0
- (no CPE)range: < 3.6.1-r19
- (no CPE)range: < 3.6.1-r19
Patches
Vulnerability mechanics
References
14- github.com/advisories/GHSA-g3pr-3p32-fp23ghsaADVISORY
- access.redhat.com/errata/RHSA-2026:36839nvd
- access.redhat.com/errata/RHSA-2026:37390nvd
- access.redhat.com/errata/RHSA-2026:41951nvd
- access.redhat.com/errata/RHSA-2026:50848nvd
- access.redhat.com/errata/RHSA-2026:50849nvd
- access.redhat.com/errata/RHSA-2026:54435nvd
- access.redhat.com/errata/RHSA-2026:62260nvd
- access.redhat.com/security/cve/CVE-2026-40984nvd
- bugzilla.redhat.com/show_bug.cginvd
- github.com/micrometer-metrics/micrometer/commit/36da131525228188a36779a28471a76c79213dd4ghsa
- nvd.nist.gov/vuln/detail/CVE-2026-40984ghsa
- security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-40984.jsonnvd
- spring.io/security/cve-2026-40984nvd
News mentions
0No linked articles in our index yet.