CVE-2026-59295 Micrometer instrumentation of Apache HttpAsyncClient DoS vulnerability
Attackers can cause denial of service via unbounded memory leaks in outbound HTTP requests using the Micrometer instrumentation library.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2026-59295?
CVE-2026-59295 is a medium-severity denial of service vulnerability in Spring Micrometer, published on 24 Aug 2026. An attacker can exploit it over the internet without logging in, with no action from the victim.
Official description
It is possible for outbound HTTP requests using a Micrometer-instrumented client to cause a denial-of-service (DoS) condition due to an unbounded memory leak. Micrometer 1.17.0 Micrometer 1.16.0 - 1.16.6 Micrometer 1.15.0 - 1.15.12 Micrometer 1.14.0 - 1.14.16 Micrometer 1.9.18 and earlier
Which versions are affected by CVE-2026-59295?
How do I fix CVE-2026-59295?
Upgrade to a fixed version.
Upgrade, then put limits on request size, rate and nesting depth so one client cannot exhaust the service. More about Denial of service.
Is CVE-2026-59295 being exploited?
There is no known exploitation of CVE-2026-59295 in the wild and no public exploit code.
Sources
Also known as CLEANSTART-2026-BD93635, CLEANSTART-2026-DF84636, CLEANSTART-2026-FL50356, CLEANSTART-2026-GT65461, GHSA-v7hr-hgg3-vv6q.