Description
In Micrometer, it is possible for a user to provide specially crafted gRPC requests that may cause a denial-of-service (DoS) condition.
Affected versions:
Micrometer 1.16.0 through 1.16.5; 1.15.0 through 1.15.11.
Affected products
| Vendor | Product | Affected | Fixed |
|---|---|---|---|
| Spring | Micrometer | 1.16.0 – < 1.16.5.1, 1.15.0 – < 1.15.11.1 | 1.16.5.1 |
Fixed in Linux distributions
Distributions backport fixes, so the version that fixes this vulnerability differs per release — upgrade to at least the version shown. From the distributions' security trackers and advisories.
Wolfi
| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Wolfi rolling | apache-nifi | No fix yet | — |
| Wolfi rolling | apicurio-registry | 3.3.1-r2 | — |
| Wolfi rolling | dependency-track +1 | 4.14.3-r1 | — |
| Wolfi rolling | infinispan-16.1 | 16.1.4-r9 | — |
| Wolfi rolling | infinispan-16.2 | 16.2.2-r1 | — |
| Wolfi rolling | keycloak-26.6 +2 | 26.6.6-r0 | — |
| Wolfi rolling | zipkin +1 | 3.6.1-r19 | — |
Affected packages
| Ecosystem | Package | Affected | Fixed | Record |
|---|---|---|---|---|
| Maven | io.micrometer:micrometer-core | >= 1.16.0, < 1.16.6 | 1.16.6 | GHSA-w737-wx49-qj23 |
| Maven | io.micrometer:micrometer-core | >= 1.15.0, < 1.15.12 | 1.15.12 | GHSA-w737-wx49-qj23 |
Advisories 2
- WID-SEC-2026-2923 Atlassian Produkte (Bamboo, Bitbucket, Confluence, Crucible, Fisheye, und Jira): Mehrere Schwachstellen BSI CERT-Bund (WID) · Nov 8, 2026
- NCSC-2026-0325 Kwetsbaarheden verholpen in Atlassian producten NCSC-NL (Netherlands) · Aug 24, 2026