About vulnerability

SVG ImageDescription

In Micrometer, it is possible for a user to provide specially crafted gRPC requests that may cause a denial-of-service (DoS) condition.

Specifically, an application is vulnerable when all of the following are true:

• the application uses a vulnerable version of io.micrometer:micrometer-core
• an ObservationRegistry is configured in the application and it records observations
• DefaultMeterObservationHandler is configured to output metrics from Observations or the user has a custom ObservationHandler that outputs metrics similarly to DefaultMeterObservationHandler
• the application uses ObservationGrpcServerInterceptor to instrument its gRPC server

SVG ImageAffected Products and Versions

Micrometer:

• 1.16.0 - 1.16.5
• 1.15.0 - 1.15.11

Older versions than 1.15.0 are not affected.

SVG ImageMitigation

Users of affected versions should upgrade to the corresponding fixed version.

No further mitigation steps are necessary.

SVG ImageCredit

The issue was identified and responsibly reported by Yu Bao (@August829) - [email protected] – who works for paypal.com.

SVG ImageReferences

• https://nvd.nist.gov/vuln-metrics/cvss/v3-calculator?vector=AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H&version=3.1

SVG ImageHistory

• 2026-06-08: Initial vulnerability report published.

SVG ImageDescription

In Micrometer, it is possible for a user to provide specially crafted gRPC requests that may cause a denial-of-service (DoS) condition.

Specifically, an application is vulnerable when all of the following are true:

• the application uses a vulnerable version of io.micrometer:micrometer-core
• an ObservationRegistry is configured in the application and it records observations
• DefaultMeterObservationHandler is configured to output metrics from Observations or the user has a custom ObservationHandler that outputs metrics similarly to DefaultMeterObservationHandler
• the application uses ObservationGrpcServerInterceptor to instrument its gRPC server

SVG ImageAffected Products and Versions

Micrometer:

• 1.16.0 - 1.16.5
• 1.15.0 - 1.15.11

Older versions than 1.15.0 are not affected.

SVG ImageMitigation

Users of affected versions should upgrade to the corresponding fixed version.

No further mitigation steps are necessary.

SVG ImageCredit

The issue was identified and responsibly reported by Yu Bao (@August829) - [email protected] – who works for paypal.com.

SVG ImageReferences

• https://nvd.nist.gov/vuln-metrics/cvss/v3-calculator?vector=AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H&version=3.1

SVG ImageHistory

• 2026-06-08: Initial vulnerability report published.