CVE-2026-40984 Micrometer HTTP server instrumentations DoS vulnerability
Attackers can cause denial of service in applications using Micrometer by sending specially crafted HTTP requests.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2026-40984?
CVE-2026-40984 is a high-severity denial of service vulnerability in Spring Micrometer, published on 9 Jun 2026. An attacker can exploit it over the internet without logging in, with no action from the victim.
Official description
In Micrometer, it is possible for a user to provide specially crafted HTTP requests that may cause a denial-of-service (DoS) condition.
Affected versions: micrometer-core 1.16.0 through 1.16.5; 1.15.0 through 1.15.11; 1.14.0 through 1.14.15; 1.13.0 through 1.13.18; 1.9.0 through 1.9.17. micrometer-jetty11 1.16.0 through 1.16.5; 1.15.0 through 1.15.11; 1.14.0 through 1.14.15; 1.13.0 through 1.13.18. micrometer-jetty12 1.16.0 through 1.16.5; 1.15.0 through 1.15.11; 1.14.0 through 1.14.15; 1.13.0 through 1.13.18.
Which versions are affected by CVE-2026-40984?
26 open source packages ship an affected version, including io.micrometer:micrometer-core, io.micrometer:micrometer-jetty11 and io.micrometer:micrometer-jetty12.
| Package | Affected | Fixed in |
|---|---|---|
io.micrometer:micrometer-core Maven | All versions to 1.9.17 | None |
io.micrometer:micrometer-core Maven | All versions to 1.9.17 | None |
io.micrometer:micrometer-core Maven | From 1.10.0 to 1.13.15 | None |
io.micrometer:micrometer-core Maven | From 1.10.0 to 1.13.15 | None |
io.micrometer:micrometer-core Maven | From 1.14.0 to 1.14.14 | None |
io.micrometer:micrometer-core Maven | From 1.14.0 to 1.14.14 | None |
20 more packages
io.micrometer:micrometer-core Maven | From 1.15.0 | 1.15.12 |
io.micrometer:micrometer-core Maven | From 1.15.0 | 1.15.12 |
io.micrometer:micrometer-core Maven | From 1.16.0 | 1.16.6 |
io.micrometer:micrometer-core Maven | From 1.16.0 | 1.16.6 |
io.micrometer:micrometer-jetty11 Maven | All versions to 1.13.15 | None |
io.micrometer:micrometer-jetty11 Maven | All versions to 1.13.15 | None |
io.micrometer:micrometer-jetty11 Maven | From 1.14.0 to 1.14.14 | None |
io.micrometer:micrometer-jetty11 Maven | From 1.14.0 to 1.14.14 | None |
io.micrometer:micrometer-jetty11 Maven | From 1.15.0 | 1.15.12 |
io.micrometer:micrometer-jetty11 Maven | From 1.15.0 | 1.15.12 |
io.micrometer:micrometer-jetty11 Maven | From 1.16.0 | 1.16.6 |
io.micrometer:micrometer-jetty11 Maven | From 1.16.0 | 1.16.6 |
io.micrometer:micrometer-jetty12 Maven | All versions to 1.13.15 | None |
io.micrometer:micrometer-jetty12 Maven | All versions to 1.13.15 | None |
io.micrometer:micrometer-jetty12 Maven | From 1.14.0 to 1.14.14 | None |
io.micrometer:micrometer-jetty12 Maven | From 1.14.0 to 1.14.14 | None |
io.micrometer:micrometer-jetty12 Maven | From 1.15.0 | 1.15.12 |
io.micrometer:micrometer-jetty12 Maven | From 1.15.0 | 1.15.12 |
io.micrometer:micrometer-jetty12 Maven | From 1.16.0 | 1.16.6 |
io.micrometer:micrometer-jetty12 Maven | From 1.16.0 | 1.16.6 |
How do I fix CVE-2026-40984?
Upgrade io.micrometer:micrometer-core to a fixed version for your release line: 1.15.12 or 1.16.6.
Upgrade, then put limits on request size, rate and nesting depth so one client cannot exhaust the service. More about Denial of service.
Is CVE-2026-40984 being exploited?
There is no known exploitation of CVE-2026-40984 in the wild and no public exploit code.
Sources
Also known as CLEANSTART-2026-BH19121, CLEANSTART-2026-FS57151, CLEANSTART-2026-QH78239, CLEANSTART-2026-SR32951, CLEANSTART-2026-UE75885, CLEANSTART-2026-UK08664 and 30 more.