Memory Leak in Apache HttpAsyncClient via MicrometerHttpClientInterceptor
CVE-2026-59295 Published on August 24, 2026
Micrometer instrumentation of Apache HttpAsyncClient DoS vulnerability
It is possible for outbound HTTP requests using a Micrometer-instrumented client to cause a denial-of-service (DoS) condition due to an unbounded memory leak.
Micrometer 1.17.0
Micrometer 1.16.0 - 1.16.6
Micrometer 1.15.0 - 1.15.12
Micrometer 1.14.0 - 1.14.16
Micrometer 1.9.18 and earlier
Vulnerability Analysis
CVE-2026-59295 can be exploited with network access, and does not require authorization privileges or user interaction. This vulnerability is consided to have a high level of attack complexity. The potential impact of an exploit of this vulnerability is considered to have no impact on confidentiality and integrity, and a high impact on availability.
Products Associated with CVE-2026-59295
stack.watch emails you whenever new vulnerabilities are published in VMware Spring Framework or Red Hat Kafka. Just hit a watch button to start following.
Affected Versions
Spring Micrometer:- Version 1.17.0 is affected.
- Version 1.16.0, <= 1.16.6 is affected.
- Version 1.15.0, <= 1.15.12 is affected.
- Version 1.14.0, <= 1.14.16 is affected.
- Before and including 1.9.18 is affected.