{"id":"GHSA-w737-wx49-qj23","summary":"Micrometer gRPC server instrumentation DoS","details":"In Micrometer, it is possible for a user to provide specially crafted gRPC requests that may cause a denial-of-service (DoS) condition.\n\nAffected versions:\nMicrometer 1.16.0 through 1.16.5; 1.15.0 through 1.15.11.","aliases":["CVE-2026-40983"],"modified":"2026-09-11T15:45:36.562871319Z","published":"2026-06-09T06:31:56Z","database_specific":{"severity":"HIGH","github_reviewed":true,"github_reviewed_at":"2026-08-06T19:05:56Z","nvd_published_at":"2026-06-09T05:16:34Z","cwe_ids":["CWE-400","CWE-770"]},"references":[{"type":"ADVISORY","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-40983"},{"type":"WEB","url":"https://access.redhat.com/errata/RHSA-2026:36839"},{"type":"WEB","url":"https://access.redhat.com/errata/RHSA-2026:41951"},{"type":"WEB","url":"https://access.redhat.com/errata/RHSA-2026:50848"},{"type":"WEB","url":"https://access.redhat.com/errata/RHSA-2026:50849"},{"type":"WEB","url":"https://access.redhat.com/errata/RHSA-2026:54435"},{"type":"WEB","url":"https://access.redhat.com/errata/RHSA-2026:62260"},{"type":"WEB","url":"https://access.redhat.com/errata/RHSA-2026:66488"},{"type":"WEB","url":"https://access.redhat.com/security/cve/CVE-2026-40983"},{"type":"WEB","url":"https://bugzilla.redhat.com/show_bug.cgi?id=2486697"},{"type":"PACKAGE","url":"https://github.com/micrometer-metrics/micrometer"},{"type":"WEB","url":"https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-40983.json"},{"type":"WEB","url":"https://spring.io/security/cve-2026-40983"}],"affected":[{"package":{"name":"io.micrometer:micrometer-core","ecosystem":"Maven","purl":"pkg:maven/io.micrometer/micrometer-core"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"1.16.0"},{"fixed":"1.16.6"}]}],"versions":["1.16.0","1.16.1","1.16.2","1.16.3","1.16.4","1.16.5"],"database_specific":{"last_known_affected_version_range":"\u003c= 1.16.5","source":"https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2026/06/GHSA-w737-wx49-qj23/GHSA-w737-wx49-qj23.json"}},{"package":{"name":"io.micrometer:micrometer-core","ecosystem":"Maven","purl":"pkg:maven/io.micrometer/micrometer-core"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"1.15.0"},{"fixed":"1.15.12"}]}],"versions":["1.15.0","1.15.1","1.15.10","1.15.11","1.15.2","1.15.3","1.15.4","1.15.5","1.15.6","1.15.7","1.15.8","1.15.9"],"database_specific":{"last_known_affected_version_range":"\u003c= 1.15.11","source":"https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2026/06/GHSA-w737-wx49-qj23/GHSA-w737-wx49-qj23.json"}}],"schema_version":"1.9.0","severity":[{"type":"CVSS_V3","score":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H"}]}