Description
In Micrometer, it is possible for a user to provide specially crafted HTTP requests that may cause a denial-of-service (DoS) condition.
Affected versions:
micrometer-core 1.16.0 through 1.16.5; 1.15.0 through 1.15.11; 1.14.0 through 1.14.15; 1.13.0 through 1.13.18; 1.9.0 through 1.9.17.
micrometer-jetty11 1.16.0 through 1.16.5; 1.15.0 through 1.15.11; 1.14.0 through 1.14.15; 1.13.0 through 1.13.18.
micrometer-jetty12 1.16.0 through 1.16.5; 1.15.0 through 1.15.11; 1.14.0 through 1.14.15; 1.13.0 through 1.13.18.
Affected products
| Vendor | Product | Affected | Fixed |
|---|---|---|---|
| Spring | Micrometer | 1.16.0 – < 1.16.5.1, 1.15.0 – < 1.15.11.1, 1.14.0 – < 1.14.16, 1.13.0 – < 1.13.19, 1.9.0 – < 1.9.18, 1.16.0 – < 1.16.5.1, 1.15.0 – < 1.15.11.1, 1.14.0 – < 1.14.16, 1.13.0 – < 1.13.19, 1.16.0 – < 1.16.6, 1.15.0 – < 1.15.11., 1.14.0 – < 1.14.15.1, 1.13.0 – < 1.13.19 | 1.16.5.1 |
Fixed in Linux distributions
Distributions backport fixes, so the version that fixes this vulnerability differs per release — upgrade to at least the version shown. From the distributions' security trackers and advisories.
Wolfi
| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Wolfi rolling | apache-nifi +3 | No fix yet | — |
| Wolfi rolling | apicurio-registry | 3.3.1-r2 | — |
| Wolfi rolling | dependency-track +1 | 4.14.3-r1 | — |
| Wolfi rolling | infinispan-16.1 | 16.1.4-r9 | — |
| Wolfi rolling | infinispan-16.2 | 16.2.2-r1 | — |
| Wolfi rolling | keycloak-26.6 +2 | 26.6.6-r0 | — |
| Wolfi rolling | zipkin +1 | 3.6.1-r19 | — |
Affected packages
Advisories 2
- WID-SEC-2026-2923 Atlassian Produkte (Bamboo, Bitbucket, Confluence, Crucible, Fisheye, und Jira): Mehrere Schwachstellen BSI CERT-Bund (WID) · Nov 8, 2026
- NCSC-2026-0325 Kwetsbaarheden verholpen in Atlassian producten NCSC-NL (Netherlands) · Aug 24, 2026