In Micrometer, it is possible for a user to provide specially crafted HTTP requests that may cause a denial-of-service (DoS) condition. Affected versions: micrometer-core 1.16.0 through 1.16.5; 1.15.0 through 1.15.11; 1.14.0 through 1.14.15; 1.13.0 through 1.13.18; 1.9.0 through 1.9.17. micrometer-jetty11 1.16.0 through 1.16.5; 1.15.0 through 1.15.11; 1.14.0 through 1.14.15; 1.13.0 through 1.13.18. micrometer-jetty12 1.16.0 through 1.16.5; 1.15.0 through 1.15.11; 1.14.0 through 1.14.15; 1.13.0 through 1.13.18.

There are packages installed that are affected by a vulnerability referenced in the following CVE:

  - In Micrometer, it is possible for a user to provide specially crafted HTTP requests that may cause a
    denial-of-service (DoS) condition. Affected versions: micrometer-core 1.16.0 through 1.16.5; 1.15.0
    through 1.15.11; 1.14.0 through 1.14.15; 1.13.0 through 1.13.18; 1.9.0 through 1.9.17. micrometer-jetty11
    1.16.0 through 1.16.5; 1.15.0 through 1.15.11; 1.14.0 through 1.14.15; 1.13.0 through 1.13.18. micrometer-
    jetty12 1.16.0 through 1.16.5; 1.15.0 through 1.15.11; 1.14.0 through 1.14.15; 1.13.0 through 1.13.18.
    (CVE-2026-40984)

ID	Name	Product	Family	Type	Severity
463707	Echo: io.micrometer:micrometer-core: security update to 1.15.12	Tenable Cloud Security	Echo Local Security Checks	Local	high
463707	Echo: io.micrometer:micrometer-core: security update to 1.15.12	Tenable Self-Hosted Container Security	Echo Local Security Checks	Local	high
445786	SCA: security update for io.micrometer:micrometer-core, io.micrometer:micrometer-jetty11, io.micrometer:micrometer-jetty12 (GHSA-g3pr-3p32-fp23)	Tenable Cloud Security	SCA Checks	Local	high
445786	SCA: security update for io.micrometer:micrometer-core, io.micrometer:micrometer-jetty11, io.micrometer:micrometer-jetty12 (GHSA-g3pr-3p32-fp23)	Tenable Self-Hosted Container Security	SCA Checks	Local	high

Detections

Analytics

CVE-2026-40984

high

Tenable Plugins

high

high

high

high