CVE-2026-59295

Micrometer-instrumented Apache HttpAsyncClient (4.x or 5.x) usage via MicrometerHttpClientInterceptor can leak memory unboundedly when asynchronous requests fail before receiving a response (e.g. connection resets or timeouts). Tracking state for these requests remains in memory indefinitely, and sustained failures lead to heap exhaustion and OutOfMemoryError crashes.

Scoring

Severity

MEDIUM

CVSS base score

5.9

CVSS vector

CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H

EPSS probability

0.22%

CWE

CWE-401

Published

2026-08-24

Last modified

2026-08-27

Affected products

• VMware (Broadcom) io.micrometer:micrometer-core
• VMware (Broadcom) io.micrometer:micrometer-core
• VMware (Broadcom) io.micrometer:micrometer-core
• VMware (Broadcom) io.micrometer:micrometer-core
• VMware (Broadcom) io.micrometer:micrometer-core
• VMware (Broadcom) io.micrometer:micrometer-core
• VMware (Broadcom) io.micrometer:micrometer-core
• VMware (Broadcom) io.micrometer:micrometer-core

Weakness type

• CWE-401

Related vulnerabilities

• CVE-2026-69781 — Windows DHCP Client Denial of Service Vulnerability
• CVE-2026-69809 — Windows Active Directory Domain Services Denial of Service Vulnerability
• CVE-2026-69497 — Windows DHCP Server Denial of Service Vulnerability
• CVE-2026-69405 — Windows DHCP Server Denial of Service Vulnerability
• CVE-2026-70065 — Windows DHCP Server Denial of Service Vulnerability
• CVE-2026-69588 — Windows TCP/IP Denial of Service Vulnerability
• CVE-2026-16028 — Protocol::HTTP2 versions before 1.14 for Perl allow memory exhaustion via closed streams that stream_state never removes from the connection stream table
• CVE-2026-18313 — rpcapd memory leak in libpcap before 1.10.7

Markdown version · Browse all CVEs