CVE-2026-40983
HIGH 7.5In Micrometer, it is possible for a user to provide specially crafted gRPC requests that may cause a denial-of-service (DoS) condition. Affected versions: Micrometer 1.16.0 through 1.16.5; 1.15.0 through 1.15.11.
ELEVATED IMPACT
Severe if exploited (CVSS 7.5), but no known exploitation and low modeled probability. Patch on a normal cadence.
Exploitation likelihood
0.5%chance of exploitation in 30 days · 38th percentile
○ In CISA KEV
○ Public exploit / PoC
Impact if exploited
7.5CVSS 3.1 · HIGH
- ConfidentialityNone
- IntegrityNone
- AvailabilityHigh
What an attacker needs
- ✓Access: Reachable over the network — no local access needed
- ✓Privileges: No account or privileges required
- ✓User interaction: No user interaction needed
- ✓Complexity: No special conditions — reliably repeatable
✓ lowers the bar for an attacker · ⚠ raises it
Affected
Products Micrometer Red Hat Amq Broker 7 Red Hat Amq Clients Red Hat Build Of Apache Camel Hawtio 4 Red Hat Build Of Apache Camel 4 For Quarkus 3 Red Hat Build Of Apicurio Registry 3 Red Hat Build Of Keycloak Red Hat Build Of Quarkus
Weakness (CWE)
- CWE-400: Uncontrolled resource consumption
- CWE-770: Allocation without limits
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H