AIKIDO-2026-11163

micrometer-core is vulnerable to Denial of Service (DoS)

Denial of Service (DoS)CVE-2026-40983 Published Jun 11, 2026

High Risk

This Affects:

micrometer-core

1.15.0 - 1.15.11

Fixed in 1.15.12

1.16.0 - 1.16.5

Fixed in 1.16.6

Are you affected? Scan for Free

TL;DR

In Micrometer, it is possible for a user to provide specially crafted gRPC requests that may cause a denial-of-service (DoS) condition.

Who does this affect?

You are affected if you are using a version that falls within the vulnerable range.

Background info

micrometer-core is vulnerable to Denial of Service (DoS) in versions 1.15.0 - 1.15.11 and 1.16.0 - 1.16.5.

How to fix this

Upgrade the io.micrometer:micrometer-core library to the patch version.

High Risk

This Affects:

micrometer-core

1.15.0 - 1.15.11

Fixed in 1.15.12

1.16.0 - 1.16.5

Fixed in 1.16.6

Are you affected? Scan for Free

Links

spring.io/security/cve-2026-40983

access.redhat.com/errata/RHSA-2026:36839

access.redhat.com/errata/RHSA-2026:41951

access.redhat.com/errata/RHSA-2026:50848

access.redhat.com/errata/RHSA-2026:50849

access.redhat.com/errata/RHSA-2026:54435

access.redhat.com/errata/RHSA-2026:62260

access.redhat.com/security/cve/CVE-2026-40983

bugzilla.redhat.com/show_bug.cgi?id=2486697

security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-40983.json

Are You Affected?

Connect your repositories to instantly see whether vulnerable or malicious packages exist in your codebase.

Scan for Free

Book a Demo

Free. No credit card required.

Company

Resources

Industries

Use Cases

Compare

Legal

Connect

hello@aikido.dev

Security

Stay up to date with all updates

I consent to receiving marketing communications based on Aikido’s Privacy Policy.

LinkedIn YouTube X

Keizer Karelstraat 15, 9000, Ghent, Belgium

95 Third St, 2nd Fl, San Francisco, CA 94103, US

Unit 6.15 Runway East 18 18 Crucifix Ln, London SE1 3JW UK

Ghent, Belgium | San Francisco, US