CVE-2026-40983 Details
Description
In Micrometer, it is possible for a user to provide specially crafted gRPC requests that may cause a denial-of-service (DoS) condition. Affected versions: Micrometer 1.16.0 through 1.16.5; 1.15.0 through 1.15.11.
A denial-of-service vulnerability has been identified in Micrometer versions 1.16.0 through 1.16.5 and 1.15.0 through 1.15.11. The issue arises when a user sends specially crafted gRPC requests that can disrupt service. An application is vulnerable if it uses affected Micrometer versions, has an ObservationRegistry that records observations, and is configured to output metrics from observations via the DefaultMeterObservationHandler or a custom observation handler. Additionally, the application must use the ObservationGrpcServerInterceptor to instrument its gRPC server.
Users of Micrometer 1.16.x should upgrade to 1.16.6, and users of Micrometer 1.15.x should upgrade to 1.15.12.
Metrics
CVSS 4.0 Severity and Vector Strings:
No CVSS 4.0 data is available for this CVE.
CVSS 3.x Severity and Vector Strings:
No data available for CVSS Version 2.0 on this CVE.
CISA-ADP
Assessed Jun 9, 2026References to Advisories, Solutions, and Tools
By selecting these links, you will be leaving this site. These are references gathered from the official CVE record and are not endorsed by Volerion.
Weakness Enumeration
| CWE-ID | CWE Name | Source |
|---|---|---|
| CWE-400 | Uncontrolled Resource Consumption | [email protected] |
| CWE-770 | Allocation of Resources Without Limits or Throttling | redhat-SADP |
Affected Products
No affected product data is available for this CVE.
Change History
20 change records found show changes
| Date | Action | Recorded By |
|---|---|---|
| Sep 14, 2026 | CVE Modified | redhat-SADP |
| Sep 11, 2026 | CVE Modified | redhat-SADP |
| Sep 2, 2026 | CVE Modified | redhat-SADP |
| Sep 1, 2026 | CVE Modified | redhat-SADP |
| Sep 1, 2026 | CVE Modified | [email protected] |
| Aug 13, 2026 | CVE Modified | redhat-SADP |
| Aug 6, 2026 | CVE Modified | redhat-SADP |
| Jul 29, 2026 | CVE Modified | redhat-SADP |
| Jul 28, 2026 | CVE Modified | redhat-SADP |
| Jul 24, 2026 | CVE Modified | redhat-SADP |
| Jul 23, 2026 | CVE Translated | [email protected] |
| Jul 21, 2026 | CVE Modified | redhat-SADP |
| Jul 15, 2026 | CVE Modified | redhat-SADP |
| Jul 9, 2026 | CVE Modified | redhat-SADP |
| Jul 6, 2026 | CVE Modified | redhat-SADP |
| Jun 30, 2026 | CVE Modified | redhat-SADP |
| Jun 23, 2026 | CVE Modified | [email protected] |
| Jun 17, 2026 | CVE Modified | [email protected] |
| Jun 17, 2026 | CVE Modified | CISA-ADP |
| Jun 9, 2026 | New CVE Received | [email protected] |