CVE-2026-40983 Micrometer gRPC server instrumentation DoS vulnerability
Attackers can cause denial of service in applications using Micrometer gRPC instrumentation by sending specially crafted requests.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2026-40983?
CVE-2026-40983 is a high-severity denial of service vulnerability in Spring Micrometer, published on 9 Jun 2026. An attacker can exploit it over the internet without logging in, with no action from the victim.
Official description
In Micrometer, it is possible for a user to provide specially crafted gRPC requests that may cause a denial-of-service (DoS) condition.
Affected versions: Micrometer 1.16.0 through 1.16.5; 1.15.0 through 1.15.11.
Which versions are affected by CVE-2026-40983?
4 open source packages ship an affected version, including io.micrometer:micrometer-core.
| Package | Affected | Fixed in |
|---|---|---|
io.micrometer:micrometer-core Maven | From 1.15.0 | 1.15.12 |
io.micrometer:micrometer-core Maven | From 1.15.0 | 1.15.12 |
io.micrometer:micrometer-core Maven | From 1.16.0 | 1.16.6 |
io.micrometer:micrometer-core Maven | From 1.16.0 | 1.16.6 |
How do I fix CVE-2026-40983?
Upgrade io.micrometer:micrometer-core to a fixed version for your release line: 1.15.12 or 1.16.6.
Upgrade, then put limits on request size, rate and nesting depth so one client cannot exhaust the service. More about Denial of service.
Is CVE-2026-40983 being exploited?
There is no known exploitation of CVE-2026-40983 in the wild and no public exploit code.
Sources
Also known as CLEANSTART-2026-BP29936, CLEANSTART-2026-EU10185, ECHO-f62f-ec03-4786, GHSA-w737-wx49-qj23, MINI-49rh-3f39-7pc9, MINI-5gwj-prwj-v9h4 and 19 more.