# CVE-2026-59295

## Summary

- **CVE ID:** CVE-2026-59295
- **Severity:** MEDIUM
- **CVSS Score:** 5.9 (CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H)
- **CWE:** CWE-401
- **Published:** Aug 24, 2026
- **Last Modified:** Aug 27, 2026

## Description

Micrometer-instrumented Apache HttpAsyncClient (4.x or 5.x) usage via MicrometerHttpClientInterceptor can leak memory unboundedly when asynchronous requests fail before receiving a response (e.g. connection resets or timeouts). Tracking state for these requests remains in memory indefinitely, and sustained failures lead to heap exhaustion and OutOfMemoryError crashes.

## Affected Products

- VMware (Broadcom) — io.micrometer:micrometer-core (0)
- VMware (Broadcom) — io.micrometer:micrometer-core (1.14.0)
- VMware (Broadcom) — io.micrometer:micrometer-core (1.15.0)
- VMware (Broadcom) — io.micrometer:micrometer-core (1.16.0)
- VMware (Broadcom) — io.micrometer:micrometer-core (1.17.0)
- VMware (Broadcom) — io.micrometer:micrometer-core (1.9.19)
- VMware (Broadcom) — io.micrometer:micrometer-core (1.14.17)
- VMware (Broadcom) — io.micrometer:micrometer-core (1.15.13)
- VMware (Broadcom) — io.micrometer:micrometer-core (1.16.7)
- VMware (Broadcom) — io.micrometer:micrometer-core (1.16.6.1)
- VMware (Broadcom) — io.micrometer:micrometer-core (1.17.1)
- VMware (Broadcom) — io.micrometer:micrometer-core (1.17.0.1)
- Spring — Micrometer (1.17.0)
- Spring — Micrometer (1.16.0)
- Spring — Micrometer (1.15.0)
- Spring — Micrometer (1.14.0)
- Spring — Micrometer (0)

## References

- [CNA](https://spring.io/security/cve-2026-59295)
- [CNA](https://github.com/spring-projects/security-advisories/security/advisories/GHSA-747c-jhq3-w433)

## Exploitation Prediction (EPSS)

- **EPSS Score:** 0.22%
- **EPSS Percentile:** 12.8

---
_Exported from OnDuty AI Vulnerability Intelligence on 2026-09-10._