CVE-2026-40983: spring micrometer Uncontrolled Resource Consumption
CVSS: 7.5v3.1HighAwaiting analysis
AliasesCGA-5f7m-f99c-qqpfCGA-5gjw-cvgq-7pr8CGA-5jjh-rfr2-w3mhCGA-5vx5-5wgj-4fmfCGA-62v9-fxqh-xm5wCGA-6576-6749-2ghxCGA-69x7-384c-wr5gCGA-6xv5-7cwp-p4h8CGA-8265-wrv5-c37mCGA-879j-c2wm-wjfpCGA-8wxc-h43f-9jpqCGA-9fm2-7gxf-hfwhCGA-9h53-7g5p-2ww3CGA-cf8j-g37v-89pcCGA-cfjm-84xh-m6rfCGA-gc97-4g94-frwqCGA-ghf7-8827-4482CGA-hcq3-j55j-8v6fCGA-q632-g5q7-24r3CGA-q8jf-q5jp-727gCGA-qp99-6xx9-rprxCGA-qv2v-v75p-gqw4CGA-rjp6-g299-vwj9CGA-x2v5-7548-6jp4CGA-2fw2-r2vf-9f73CGA-32p9-j36h-p3mfCGA-48fc-cf4f-xwrxCGA-4jf7-wpjc-q89cCGA-4mfm-xf7v-p9f2CGA-4wwx-x85f-hq6cCGA-58r6-rj74-5xmpCGA-5c2v-8g2h-76f9CGA-5f9v-j844-vc7pCGA-5w6j-698w-rgcqCGA-62h7-fwj7-q7ccCGA-62jr-3hc2-92g8CGA-664m-wh3v-4j2gCGA-6wfr-39g9-m983CGA-72cv-wrh3-4x44CGA-7h9m-474w-3vvgCGA-7m5f-3m2j-qx8wCGA-7vvq-p275-rcvhCGA-c967-rq86-q526CGA-f66c-j69j-jxrfCGA-f7m9-pxvq-rg4jCGA-fp3v-w298-8f5vCGA-frxq-4xxr-2fq5CGA-g543-qjmj-84pxCGA-gr94-pj2r-xgp2CGA-h4f2-j82p-3p94CGA-h725-w5r8-m2cjCGA-hpp9-hr5f-jmg2CGA-hwxq-39j9-pc7mCGA-j84c-qxrg-mj2mCGA-mph8-mjqc-9ccmCGA-mr2x-wcw5-fc3gCGA-mrw8-39x9-m57cCGA-p56p-c5q6-jqwpCGA-pgf5-6jwx-66j4CGA-pw2j-xmfh-mvqfGHSA-w737-wx49-qj23CGA-q6fh-c97f-rh64CGA-qfxj-j2wx-jwppCGA-v9xv-266g-7529CGA-vj35-2cjx-75rhCGA-w27f-3r38-62g8CGA-w3f6-5cw5-ghqhCGA-x4pw-7rqw-p7m4
Published 09-06-2026Last modified 14-09-2026
Vulnerability summary
CVE-2026-40983 is a high (CVSS 7.5) Uncontrolled Resource Consumption vulnerability in spring micrometer. EPSS estimates a 0.85% chance of exploitation in the next 30 days, higher than 57.3% of scored vulnerabilities.
CVSS score
7.5/10
010
High · v3.1 (CVE.org)EPSS score
0.85%
0%100%
Low · +0.22 pp in 30 daysKEVNot listedIn no KEV catalog
RansomwareNone recordedNo known use recorded
Public exploits0No public exploits recorded
Advisory lineage
Upstream 0 · Downstream 0 · Related 1Timeline
- 09-06-2026PublishedVulnerability first disclosed.
- 14-09-2026Last modifiedVulnerability information updated.
Description
In Micrometer, it is possible for a user to provide specially crafted gRPC requests that may cause a denial-of-service (DoS) condition. Affected versions: Micrometer 1.16.0 through 1.16.5; 1.15.0 through 1.15.11.
CVSS metrics
5 scores · 5 sources · 1 versionHigh 7.5Preferred score · CVE.org (CNA)
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:HSourcesAll 5 agree
- OSV · WolfiEcosystem advisory · calculated7.5HighCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
- OSV · ChainguardEcosystem advisory · calculated7.5HighCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
- OSV · MavenEcosystem advisory · calculated7.5HighCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
- NVDNIST7.5HighCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
EPSS trend
Probability
0.85%
Chance of exploitation in the next 30 days
Percentile
57%
Versus all other CVEs
30-day change
+0.22 pp
From 0.63% on 18-09-2026
18-09-202618-10-2026
EPSS score0.85%
Known exploited
Compare KEV catalogsNot in any of the 3 tracked catalogs.
Public exploits
0 foundNo public exploits indexed.
Weaknesses
CWE · root cause- CWE-400Uncontrolled Resource ConsumptionThe product does not properly control the allocation and maintenance of a limited resource.
- CWE-770Allocation of Resources Without Limits or ThrottlingThe product allocates a reusable resource or group of resources on behalf of an actor without imposing any intended restrictions on the size or number of resources that can be allocated.
Affected systems
Chainguard32 products
- airbyte-server< 2.0.0-r9
- airbyte-server-fips< 2.0.0-r11
- apache-nifiAll versions (No fix recorded)
- apache-nifi-2.11< 2.11.0-r1
- apicurio-registry< 3.3.1-r2
Wolfi11 products
- apache-nifiAll versions (No fix recorded)
- apicurio-registry< 3.3.1-r2
- dependency-track< 4.14.3-r1
- dependency-track-bundled< 4.14.3-r1
- infinispan-16.1< 16.1.4-r9
Io.micrometer1 product
- micrometer-core≥ 1.16.0, < 1.16.6 | ≥ 1.15.0, < 1.15.12
Spring1 product
- micrometer≥ 1.16.0, < 1.16.5.1 | ≥ 1.15.0, < 1.15.11.1
4 vendors · 45 products
