CVE-2026-59323 Micrometer Tracing Brave Bridge W3C Baggage propagation DoS vulnerability
Attackers can cause denial of service via unbounded memory allocation in Micrometer Tracing when W3C baggage propagation is enabled.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2026-59323?
CVE-2026-59323 is a medium-severity denial of service vulnerability in Spring Micrometer Tracing, published on 21 Aug 2026. An attacker can exploit it over the internet without logging in, with no action from the victim.
Official description
An application using Micrometer Tracing with W3C baggage propagation in the Brave bridge is vulnerable to denial of service (DoS) due to unbounded object allocation when extracting incoming baggage headers. Micrometer Tracing 1.7.0 Micrometer Tracing 1.6.0 - 1.6.6 Micrometer Tracing 1.5.0 - 1.5.12 Micrometer Tracing 1.4.13 and earlier
Weakness: CWE-770
Which versions are affected by CVE-2026-59323?
How do I fix CVE-2026-59323?
Upgrade to a fixed version.
Upgrade, then put limits on request size, rate and nesting depth so one client cannot exhaust the service. More about Denial of service.
Is CVE-2026-59323 being exploited?
There is no known exploitation of CVE-2026-59323 in the wild and no public exploit code.
Sources
Also known as CLSA-2026-1792395367, CLSA-2026-1792395420, GHSA-rj39-56xf-v987.