Back spring.io CVE-2026-40983: Micrometer gRPC server instrumentation DoS vulnerability
In Micrometer, it is possible for a user to provide specially crafted gRPC requests that may cause a denial-of-service (DoS) condition.
Specifically, an application is vulnerable when all of the following are true:
Older versions than 1.15.0 are not affected.
Users of affected versions should upgrade to the corresponding fixed version.
No further mitigation steps are necessary.
The issue was identified and responsibly reported by Yu Bao (@August829) - [email protected] – who works for paypal.com.
To report a security vulnerability for a project within the Spring portfolio, see the Security Policy
Tanzu Spring offers support and binaries for OpenJDK™, Spring, and Apache Tomcat® in one simple subscription.
Check out all the upcoming events in the Spring community.
The full story
This article is one source in a clustered incident — the cluster page carries the summary, timeline and every other outlet covering it.
