About vulnerability

[SVG Image](#description)Description

In Micrometer, it is possible for a user to provide specially crafted gRPC requests that may cause a denial-of-service (DoS) condition.

Specifically, an application is vulnerable when all of the following are true:

• the application uses a vulnerable version of io.micrometer:micrometer-core
• an ObservationRegistry is configured in the application and it records observations
• DefaultMeterObservationHandler is configured to output metrics from Observations or the user has a custom ObservationHandler that outputs metrics similarly to DefaultMeterObservationHandler
• the application uses ObservationGrpcServerInterceptor to instrument its gRPC server

[SVG Image](#affected-products-and-versions)Affected Products and Versions

Micrometer:

• 1.16.0 - 1.16.5
• 1.15.0 - 1.15.11

Older versions than 1.15.0 are not affected.

[SVG Image](#mitigation)Mitigation

Users of affected versions should upgrade to the corresponding fixed version.

No further mitigation steps are necessary.

[SVG Image](#credit)Credit

The issue was identified and responsibly reported by [Yu Bao (@August829)](https://github.com/August829) - <[email protected]> – who works for paypal.com.

[SVG Image](#references)References

• <https://nvd.nist.gov/vuln-metrics/cvss/v3-calculator?vector=AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H&version=3.1>

[SVG Image](#history)History

• 2026-06-08: Initial vulnerability report published.

Affected product:

Apache CXF , Hibernate , Spring , camel , geode , micrometer , rsocket-java , wildfly

Affected packages:

hibernate-agroal @ 6.0.2.Final (+3801 more)