CVE-2026-59295

About vulnerability

It is possible for outbound HTTP requests using a Micrometer-instrumented client to cause a denial-of-service (DoS) condition due to an unbounded memory leak.

Specifically, an application is vulnerable when all the following are true:

• The application uses a vulnerable version of io.micrometer:micrometer-core.
• The application instruments an Apache HttpAsyncClient (4.x or 5.x) with MicrometerHttpClientInterceptor.
• Outbound requests target a hostile or unreliable remote endpoint, or can be subjected to pre-response transport failures.

When an outbound asynchronous HTTP request fails before any response message is received (such as a connection reset, connection timeout, or socket failure), the tracking state is never removed from the interceptor. Under sustained connection failures, this leads to unbounded JVM heap memory leak and eventual application crash via OutOfMemoryError.

Affected product:

Apache CXF , Hibernate , Spring , Wildfly , activemq , artemis , azure-sdk-for-java , azure-spring-data-cosmos , camel , cassandra-java-driver , geode , infinispan , micrometer , micrometer-tracing , rsocket-java

Affected packages:

Spring Integration @ 5.5.19 (+6282 more)