CVE-2026-40984: Micrometer HTTP server instrumentations DoS vulnerability

In Micrometer, it is possible for a user to provide specially crafted HTTP requests that may cause a denial-of-service (DoS) condition.

Specifically, an application is vulnerable when all of the following are true:

Versions that are no longer supported are also affected.

Users of affected versions should upgrade to the corresponding fixed version.

No further mitigation steps are necessary.

The issue was identified and responsibly reported by Yu Bao (@August829) - [email protected] – who works for paypal.com.

To report a security vulnerability for a project within the Spring portfolio, see the Security Policy

Tanzu Spring offers support and binaries for OpenJDK™, Spring, and Apache Tomcat® in one simple subscription.

Check out all the upcoming events in the Spring community.