CVE-2026-59295

{"dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": {"cveId": "CVE-2026-59295", "assignerOrgId": "dcf2e128-44bd-42ed-91e8-88f912c1401d", "state": "PUBLISHED", "assignerShortName": "vmware", "dateReserved": "2026-07-04T18:13:34.323Z", "datePublished": "2026-08-24T10:10:06.302Z", "dateUpdated": "2026-08-27T17:57:52.554Z"}, "containers": {"cna": {"providerMetadata": {"orgId": "dcf2e128-44bd-42ed-91e8-88f912c1401d", "shortName": "vmware", "dateUpdated": "2026-08-27T17:57:52.554Z"}, "title": "Micrometer instrumentation of Apache HttpAsyncClient DoS vulnerability", "problemTypes": [{"descriptions": [{"lang": "en", "description": "CWE-401 Missing Release of Memory after Effective Lifetime", "type": "CWE"}]}], "impacts": [{"descriptions": [{"lang": "en", "value": "It is possible for outbound HTTP requests using a Micrometer-instrumented client to cause a denial-of-service (DoS) condition due to an unbounded memory leak."}]}], "affected": [{"vendor": "Spring", "product": "Micrometer", "versions": [{"status": "affected", "version": "1.17.0", "versionType": "custom"}, {"status": "affected", "version": "1.16.0", "lessThanOrEqual": "1.16.6", "versionType": "custom"}, {"status": "affected", "version": "1.15.0", "lessThanOrEqual": "1.15.12", "versionType": "custom"}, {"status": "affected", "version": "1.14.0", "lessThanOrEqual": "1.14.16", "versionType": "custom"}, {"status": "affected", "version": "0", "lessThanOrEqual": "1.9.18", "versionType": "custom"}], "defaultStatus": "unaffected"}], "descriptions": [{"lang": "en", "value": "It is possible for outbound HTTP requests using a Micrometer-instrumented client to cause a denial-of-service (DoS) condition due to an unbounded memory leak.\nMicrometer 1.17.0\nMicrometer 1.16.0 - 1.16.6\nMicrometer 1.15.0 - 1.15.12\nMicrometer 1.14.0 - 1.14.16\nMicrometer 1.9.18 and earlier", "supportingMedia": [{"type": "text/html", "base64": false, "value": "<p>It is possible for outbound HTTP requests using a Micrometer-instrumented client to cause a denial-of-service (DoS) condition due to an unbounded memory leak.</p><p>Micrometer 1.17.0<br/>Micrometer 1.16.0 - 1.16.6<br/>Micrometer 1.15.0 - 1.15.12<br/>Micrometer 1.14.0 - 1.14.16<br/>Micrometer 1.9.18 and earlier</p>"}]}], "references": [{"url": "https://spring.io/security/cve-2026-59295"}], "metrics": [{"format": "CVSS", "scenarios": [{"lang": "en", "value": "GENERAL"}], "cvssV3_1": {"version": "3.1", "vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H", "baseScore": 5.9, "baseSeverity": "MEDIUM", "attackVector": "NETWORK", "attackComplexity": "HIGH", "privilegesRequired": "NONE", "userInteraction": "NONE", "scope": "UNCHANGED", "confidentialityImpact": "NONE", "integrityImpact": "NONE", "availabilityImpact": "HIGH"}}], "source": {"discovery": "UNKNOWN"}}, "adp": [{"metrics": [{"other": {"type": "ssvc", "content": {"timestamp": "2026-08-24T14:28:32.372143Z", "id": "CVE-2026-59295", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "partial"}], "role": "CISA Coordinator", "version": "2.0.3"}}}], "title": "CISA ADP Vulnrichment", "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-08-24T14:28:42.575Z"}}]}}

{"dataType": "CVE_RECORD", "containers": {"adp": [{"title": "CISA ADP Vulnrichment", "metrics": [{"other": {"type": "ssvc", "content": {"id": "CVE-2026-59295", "role": "CISA Coordinator", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "partial"}], "version": "2.0.3", "timestamp": "2026-08-24T14:28:32.372143Z"}}}], "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-08-24T14:28:39.220Z"}}], "cna": {"title": "Micrometer Instrumentation of Apache HttpAsyncClient Denial of Service Vulnerability", "metrics": [{"format": "CVSS", "cvssV3_1": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 5.9, "attackVector": "NETWORK", "baseSeverity": "MEDIUM", "vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H", "integrityImpact": "NONE", "userInteraction": "NONE", "attackComplexity": "HIGH", "availabilityImpact": "HIGH", "privilegesRequired": "NONE", "confidentialityImpact": "NONE"}, "scenarios": [{"lang": "en", "value": "GENERAL"}]}], "affected": [{"vendor": "VMware (Broadcom)", "product": "io.micrometer:micrometer-core", "versions": [{"status": "affected", "version": "0", "versionType": "semver", "lessThanOrEqual": "1.9.18"}, {"status": "affected", "version": "1.14.0", "versionType": "semver", "lessThanOrEqual": "1.14.16"}, {"status": "affected", "version": "1.15.0", "versionType": "semver", "lessThanOrEqual": "1.15.12"}, {"status": "affected", "version": "1.16.0", "versionType": "semver", "lessThanOrEqual": "1.16.6"}, {"status": "affected", "version": "1.17.0", "versionType": "semver"}, {"status": "unaffected", "version": "1.9.19", "versionType": "semver"}, {"status": "unaffected", "version": "1.14.17", "versionType": "semver"}, {"status": "unaffected", "version": "1.15.13", "versionType": "semver"}, {"status": "unaffected", "version": "1.16.7", "versionType": "semver"}, {"status": "unaffected", "version": "1.16.6.1", "versionType": "custom"}, {"status": "unaffected", "version": "1.17.1", "versionType": "semver"}, {"status": "unaffected", "version": "1.17.0.1", "versionType": "custom"}]}], "datePublic": "2026-08-20T00:00:00.000Z", "references": [{"url": "https://spring.io/security/cve-2026-59295", "name": "Spring Security Advisory CVE-2026-59295"}, {"url": "https://github.com/spring-projects/security-advisories/security/advisories/GHSA-747c-jhq3-w433", "name": "GHSA-747c-jhq3-w433"}], "workarounds": [{"lang": "en", "value": "Migrate to Apache HttpClient 5.6.x's native httpclient5-observation module, or use ObservationExecChainHandler when using HttpClient 5.x with Micrometer 1.12.0+.", "supportingMedia": [{"type": "text/html", "value": "<p>Migrate to Apache HttpClient 5.6.x's native httpclient5-observation module, or use ObservationExecChainHandler when using HttpClient 5.x with Micrometer 1.12.0+.</p>", "base64": false}]}], "descriptions": [{"lang": "en", "value": "Micrometer-instrumented Apache HttpAsyncClient (4.x or 5.x) usage via MicrometerHttpClientInterceptor can leak memory unboundedly when asynchronous requests fail before receiving a response (e.g. connection resets or timeouts). Tracking state for these requests remains in memory indefinitely, and sustained failures lead to heap exhaustion and OutOfMemoryError crashes.", "supportingMedia": [{"type": "text/html", "value": "<p>Micrometer-instrumented Apache HttpAsyncClient (4.x or 5.x) usage via MicrometerHttpClientInterceptor can leak memory unboundedly when asynchronous requests fail before receiving a response (e.g. connection resets or timeouts). Tracking state for these requests remains in memory indefinitely, and sustained failures lead to heap exhaustion and OutOfMemoryError crashes.</p>", "base64": false}]}], "problemTypes": [{"descriptions": [{"lang": "en", "type": "CWE", "cweId": "CWE-401", "description": "CWE-401: Missing Release of Memory after Effective Lifetime"}]}], "providerMetadata": {"orgId": "dcf2e128-44bd-42ed-91e8-88f912c1401d", "shortName": "vmware", "dateUpdated": "2026-08-24T10:10:06.302Z"}}}, "cveMetadata": {"cveId": "CVE-2026-59295", "state": "PUBLISHED", "dateUpdated": "2026-08-24T14:28:42.575Z", "dateReserved": "2026-07-04T18:13:34.323Z", "assignerOrgId": "dcf2e128-44bd-42ed-91e8-88f912c1401d", "datePublished": "2026-08-24T10:10:06.302Z", "assignerShortName": "vmware"}, "dataVersion": "5.2"}

{"affected": [{"affectedData": [{"defaultStatus": "unaffected", "product": "Micrometer", "vendor": "Spring", "versions": [{"status": "affected", "version": "1.17.0", "versionType": "custom"}, {"lessThanOrEqual": "1.16.6", "status": "affected", "version": "1.16.0", "versionType": "custom"}, {"lessThanOrEqual": "1.15.12", "status": "affected", "version": "1.15.0", "versionType": "custom"}, {"lessThanOrEqual": "1.14.16", "status": "affected", "version": "1.14.0", "versionType": "custom"}, {"lessThanOrEqual": "1.9.18", "status": "affected", "version": "0", "versionType": "custom"}]}], "source": "security@vmware.com"}], "cveTags": [], "descriptions": [{"lang": "en", "value": "It is possible for outbound HTTP requests using a Micrometer-instrumented client to cause a denial-of-service (DoS) condition due to an unbounded memory leak.\nMicrometer 1.17.0\nMicrometer 1.16.0 - 1.16.6\nMicrometer 1.15.0 - 1.15.12\nMicrometer 1.14.0 - 1.14.16\nMicrometer 1.9.18 and earlier"}, {"lang": "es", "value": "El uso de Apache HttpAsyncClient (4.x o 5.x) instrumentado con Micrometer a trav\u00e9s de MicrometerHttpClientInterceptor puede filtrar memoria de forma ilimitada cuyo las solicitudes as\u00edncronas fallan antes de recibir una respuesta (p. ej., restablecimientos de conexi\u00f3n o tiempos de espera). El estado de seguimiento para estas solicitudes permanece en memoria indefinidamente, y los fallos sostenidos conducen al agotamiento del heap y a bloqueos por OutOfMemoryError."}], "id": "CVE-2026-59295", "lastModified": "2026-10-12T15:10:00.207", "metrics": {"cvssMetricV31": [{"cvssData": {"attackComplexity": "HIGH", "attackVector": "NETWORK", "availabilityImpact": "HIGH", "baseScore": 5.9, "baseSeverity": "MEDIUM", "confidentialityImpact": "NONE", "integrityImpact": "NONE", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H", "version": "3.1"}, "exploitabilityScore": 2.2, "impactScore": 3.6, "source": "security@vmware.com", "type": "Secondary"}], "ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2026-59295", "options": [{"exploitation": "none"}, {"automatable": "no"}, {"technicalImpact": "partial"}], "role": "CISA Coordinator", "timestamp": "2026-08-24T14:28:32.372143Z", "version": "2.0.3"}}]}, "published": "2026-08-24T11:16:39.780", "references": [{"source": "security@vmware.com", "url": "https://spring.io/security/cve-2026-59295"}], "sourceIdentifier": "security@vmware.com", "vulnStatus": "Awaiting Analysis"}

{"bugzilla": {"description": "io.micrometer/micrometer-core: Micrometer Instrumentation for Apache HttpAsyncClient: Denial of Service via asynchronous request failures", "id": "2521797", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2521797"}, "csaw": false, "cwe": "CWE-772", "details": ["Micrometer-instrumented Apache HttpAsyncClient (4.x or 5.x) usage via MicrometerHttpClientInterceptor can leak memory unboundedly when asynchronous requests fail before receiving a response (e.g. connection resets or timeouts). Tracking state for these requests remains in memory indefinitely, and sustained failures lead to heap exhaustion and OutOfMemoryError crashes.", "A flaw was found in Micrometer Instrumentation for Apache HttpAsyncClient. When asynchronous requests fail before receiving a response, such as due to connection resets or timeouts, the system can leak memory unboundedly. This continuous memory leak leads to heap exhaustion and OutOfMemoryError crashes, resulting in a Denial of Service (DoS) for the affected application."], "mitigation": {"lang": "en:us", "value": "Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base, or stability."}, "name": "CVE-2026-59295", "package_state": [{"cpe": "cpe:/a:redhat:exploit_intelligence:0", "fix_state": "Not affected", "package_name": "exploit-intelligence/agent-client-rhel9", "product_name": "Exploit Intelligence"}, {"cpe": "cpe:/a:redhat:amq_broker:7", "fix_state": "Affected", "package_name": "micrometer-core", "product_name": "Red Hat AMQ Broker 7"}, {"cpe": "cpe:/a:redhat:camel_quarkus:3", "fix_state": "Not affected", "package_name": "micrometer-core", "product_name": "Red Hat build of Apache Camel 4 for Quarkus 3"}, {"cpe": "cpe:/a:redhat:camel_spring_boot:4", "fix_state": "Not affected", "package_name": "micrometer-core", "product_name": "Red Hat build of Apache Camel for Spring Boot 4"}, {"cpe": "cpe:/a:redhat:apicurio_registry:3", "fix_state": "Not affected", "package_name": "micrometer-core", "product_name": "Red Hat build of Apicurio Registry 3"}, {"cpe": "cpe:/a:redhat:debezium:3", "fix_state": "Not affected", "package_name": "micrometer-core", "product_name": "Red Hat build of Debezium 3"}, {"cpe": "cpe:/a:redhat:build_keycloak:", "fix_state": "Not affected", "package_name": "keycloak/rhbk-openshift-rhel9", "product_name": "Red Hat Build of Keycloak"}, {"cpe": "cpe:/a:redhat:build_keycloak:", "fix_state": "Not affected", "package_name": "keycloak/rhbk-rhel9-operator", "product_name": "Red Hat Build of Keycloak"}, {"cpe": "cpe:/a:redhat:build_keycloak:", "fix_state": "Not affected", "package_name": "micrometer-core", "product_name": "Red Hat Build of Keycloak"}, {"cpe": "cpe:/a:redhat:build_keycloak:", "fix_state": "Not affected", "package_name": "rhbk/keycloak-rhel9", "product_name": "Red Hat Build of Keycloak"}, {"cpe": "cpe:/a:redhat:build_keycloak:", "fix_state": "Not affected", "package_name": "rhbk/keycloak-rhel9-operator", "product_name": "Red Hat Build of Keycloak"}, {"cpe": "cpe:/a:redhat:quarkus:3", "fix_state": "Affected", "package_name": "micrometer-core", "product_name": "Red Hat build of Quarkus"}, {"cpe": "cpe:/a:redhat:jboss_data_grid:8", "fix_state": "Not affected", "package_name": "micrometer-core", "product_name": "Red Hat Data Grid 8"}, {"cpe": "cpe:/a:redhat:jboss_fuse:7", "fix_state": "Not affected", "package_name": "micrometer-core", "product_name": "Red Hat Fuse 7"}, {"cpe": "cpe:/a:redhat:jboss_enterprise_application_platform:8", "fix_state": "Not affected", "package_name": "micrometer-core", "product_name": "Red Hat JBoss Enterprise Application Platform 8"}, {"cpe": "cpe:/a:redhat:jbosseapxp", "fix_state": "Not affected", "package_name": "micrometer-core", "product_name": "Red Hat JBoss Enterprise Application Platform Expansion Pack"}, {"cpe": "cpe:/a:redhat:openshift_ai", "fix_state": "Not affected", "package_name": "rhoai/odh-trustyai-service-rhel9", "product_name": "Red Hat OpenShift AI (RHOAI)"}, {"cpe": "cpe:/a:redhat:openshift_devspaces:3", "fix_state": "Not affected", "package_name": "devspaces/openvsx-rhel9", "product_name": "Red Hat OpenShift Dev Spaces"}, {"cpe": "cpe:/a:redhat:openshift_devspaces:3", "fix_state": "Not affected", "package_name": "devspaces/pluginregistry-rhel9", "product_name": "Red Hat OpenShift Dev Spaces"}, {"cpe": "cpe:/a:redhat:openshift_devspaces:3", "fix_state": "Not affected", "package_name": "devspaces/server-rhel9", "product_name": "Red Hat OpenShift Dev Spaces"}, {"cpe": "cpe:/a:redhat:satellite:6", "fix_state": "Not affected", "package_name": "candlepin", "product_name": "Red Hat Satellite 6"}], "public_date": "2026-08-24T10:10:06Z", "references": ["https://www.cve.org/CVERecord?id=CVE-2026-59295\nhttps://nvd.nist.gov/vuln/detail/CVE-2026-59295\nhttps://github.com/spring-projects/security-advisories/security/advisories/GHSA-747c-jhq3-w433\nhttps://spring.io/security/cve-2026-59295"], "statement": "This Moderate severity flaw impacts Red Hat products utilizing Micrometer-instrumented Apache HttpAsyncClient. The vulnerability can lead to a denial of service due to unbounded memory growth when asynchronous requests fail before a response is received. Exploitation requires specific network conditions or failures, making the attack complexity high.", "threat_severity": "Moderate"}

{"affected": [{"configurations": [{"platform": null, "status": "affected", "versions": {"scheme": "semver", "value": "[0,1.9.18]"}}, {"platform": null, "status": "affected", "versions": {"scheme": "semver", "value": "[1.14.0,1.14.16]"}}, {"platform": null, "status": "affected", "versions": {"scheme": "semver", "value": "[1.15.0,1.15.12]"}}, {"platform": null, "status": "affected", "versions": {"scheme": "semver", "value": "[1.16.0,1.16.6]"}}, {"platform": null, "status": "affected", "versions": {"scheme": "semver", "value": "1.17.0"}}, {"platform": null, "status": "unaffected", "versions": {"scheme": "semver", "value": "1.9.19"}}, {"platform": null, "status": "unaffected", "versions": {"scheme": "semver", "value": "1.14.17"}}, {"platform": null, "status": "unaffected", "versions": {"scheme": "semver", "value": "1.15.13"}}, {"platform": null, "status": "unaffected", "versions": {"scheme": "semver", "value": "1.16.7"}}, {"platform": null, "status": "unaffected", "versions": {"scheme": "generic", "value": "1.16.6.1"}}, {"platform": null, "status": "unaffected", "versions": {"scheme": "semver", "value": "1.17.1"}}, {"platform": null, "status": "unaffected", "versions": {"scheme": "generic", "value": "1.17.0.1"}}], "enrichment": {"confidence": 100.0, "confidence_source": "manual", "scores": [{"score": 100.0, "source": "manual"}]}, "original": {"product": "io.micrometer:micrometer-core", "source": "cna", "vendor": "VMware (Broadcom)"}, "product": "micrometer", "vendor": "spring"}], "created": "2026-08-24T11:30:03.585801+00:00", "updated": "2026-08-28T20:15:06.350779+00:00", "vendors": ["spring", "spring$PRODUCT$micrometer"]}