Signal is active with 1 mentions in latest observed window
Recommended action window: Monitor and triage in normal cycle
NVD description
In Micrometer, it is possible for a user to provide specially crafted HTTP requests that may cause a denial-of-service (DoS) condition. Affected versions: micrometer-core 1.16.0 through 1.16.5; 1.15.0 through 1.15.11; 1.14.0 through 1.14.15; 1.13.0 through 1.13.18; 1.9.0 through 1.9.17. micrometer-jetty11 1.16.0 through 1.16.5; 1.15.0 through 1.15.11; 1.14.0 through 1.14.15; 1.13.0 through 1.13.18. micrometer-jetty12 1.16.0 through 1.16.5; 1.15.0 through 1.15.11; 1.14.0 through 1.14.15; 1.13.0 through 1.13.18.
Priority
LOW
Exploitation
NONE
PoC
NONE
Patch
AVAILABLE
Momentum
STABLE
| Date | Total | Labels |
|---|
| 2026-06-09 | 1 | Patch1 |
| 2026-06-19 | 1 | General1 |
⚠️ Vulnerabilidades en productos Spring ❗ CVE-2026-40984 ❗ CVE-2026-40983 ➡️ Más info: https://www.cert.gov.py/vulnerabilidades-en-productos-spring-9/ https://t.co/m5o3e0dKuy
Post summary
The tweet simply lists two CVE identifiers for Spring products and points to a URL for additional information, without providing detailed technical context or exploit details.
🚨High - Micrometer HTTP Server Instrumentation DoS (CVE-2026-40984) Micrometer's HTTP server instrumentations contain an uncontrolled resource consumption flaw (CWE-400). An attacker can send specially crafted HTTP requests that the instrumentation processes, driving the application toward a denial-of-service condition. It's remotely exploitable over the network by an unauthenticated attacker, with low attack complexity and no user interaction required. Impact is availability-only - no data exposure or integrity loss - but Micrometer is a near-default observability dependency across Spring Boot and other JVM services, so the exposed surface is broad wherever HTTP server instrumentation is enabled. Affected modules: micrometer-core, micrometer-jetty11, and micrometer-jetty12. 👉Upgrade to micrometer-core 1.16.6, 1.15.12, 1.14.16, 1.13.19, or 1.9.18 (jetty11/jetty12 modules: 1.16.6, 1.15.12, 1.14.16, 1.13.19).
Post summary
Micrometer’s HTTP server instrumentation suffers a denial‑of‑service CVE‑2026‑40984; vulnerable modules are listed and patch versions are provided for remediation.