CVE-2026-59295

Overview

Micrometer is a vendor-neutral application metrics facade for the JVM: instrumentation code records timers, counters and gauges against a MeterRegistry, and a registry implementation exports them to a monitoring backend. micrometer-core is the facade and the instrumentation itself, and it ships the Apache HttpComponents client instrumentation, including the MicrometerHttpClientInterceptor request and response interceptor pair that times outbound HTTP calls made with Apache HttpAsyncClient.

A Denial of Service (DoS) vulnerability (CVE-2026-59295) has been identified in MicrometerHttpClientInterceptor, which allows attackers to exhaust the JVM heap of an instrumented application by causing asynchronous HTTP requests to terminate before any response is received, leaving one in-flight timer sample retained per failed request until the process fails with an OutOfMemoryError.

Per OWASP: The Denial of Service (DoS) attack is focused on making a resource (site, application, server) unavailable for the purpose it was designed. There are many ways to make a service unavailable for legitimate users by manipulating network packets, programming, logical, or resources handling vulnerabilities, among others. If a service receives a very large number of requests, it may cease to be available to legitimate users. In the same way, a service may stop if a programming vulnerability is exploited, or the way the service handles resources it uses.

This issue affects the Apache HttpComponents client instrumentation of Micrometer, in both the Apache HttpComponents 4 and the Apache HttpComponents 5 variants of MicrometerHttpClientInterceptor.

Details

Module Info

• Product: Micrometer
• Affected packages: io.micrometer:micrometer-core
• Affected versions: >=1.4.0 <=1.9.18, >=1.10.0 <=1.14.16, >=1.15.0 <=1.15.12, >=1.16.0 <=1.16.6, 1.17.0
• GitHub repository: https://github.com/micrometer-metrics/micrometer
• Published packages: https://central.sonatype.com/artifact/io.micrometer/micrometer-core
• Package manager: Maven
• Fixed in: NES for Micrometer
• NES versions: 1.15.12-micrometer-1.15.14 (NES 1.15.x line), 1.9.17-micrometer-1.9.19 (NES 1.9.x line)
• OSS versions: Micrometer 1.16.7, Micrometer 1.17.1

Vulnerability Info

This Medium-severity vulnerability is found in the io.micrometer:micrometer-core package in the Apache HttpComponents client instrumentation of Micrometer.

MicrometerHttpClientInterceptor tracks each outbound request by parking a Timer.ResourceSample in a process-wide map keyed by the request's HttpContext. The map is populated by the request interceptor and is only ever drained by the response interceptor:

public class MicrometerHttpClientInterceptor {

    private static final String METER_NAME = "httpcomponents.httpclient.request";

    private final Map<HttpContext, Timer.ResourceSample> timerByHttpContext = new ConcurrentHashMap<>();

    private final HttpRequestInterceptor requestInterceptor;

    private final HttpResponseInterceptor responseInterceptor;

    public MicrometerHttpClientInterceptor(MeterRegistry meterRegistry, Function<HttpRequest, String> uriMapper,
            Iterable<Tag> extraTags, boolean exportTagsForRoute) {

        this.requestInterceptor = (request, context) -> timerByHttpContext.put(context,
                Timer.resource(meterRegistry, METER_NAME)
                    .tags("method", request.getRequestLine().getMethod(), "uri", uriMapper.apply(request)));

        this.responseInterceptor = (response, context) -> {
            timerByHttpContext.remove(context)
                .tag("status", Integer.toString(response.getStatusLine().getStatusCode()))
                .tag("outcome", Outcome.forStatus(response.getStatusLine().getStatusCode()).name())
                .tags(exportTagsForRoute ? HttpContextUtils.generateTagsForRoute(context) : Tags.empty())
                .tags(extraTags)
                .close();
        };
    }
}

The interceptor pair is registered on an Apache HttpAsyncClient instance, so the response interceptor runs only when a response actually arrives. Any request that ends without a response, for example a connection reset, a connect or socket timeout, a TLS handshake failure or a cancelled exchange, never reaches the removal path, and its entry stays in timerByHttpContext for the lifetime of the client. Whenever the instrumented application can be induced to call a host the attacker influences, or simply sits behind a network path the attacker can disrupt, a sustained stream of failing requests grows the map without bound. Each retained entry holds the sample along with its tags and the HttpContext used as the key, so heap usage climbs until the JVM throws an OutOfMemoryError and the application stops serving traffic.

The same code path also dereferences the result of timerByHttpContext.remove(context) without a null check, so a response that carries an HttpContext with no recorded sample, such as a response delivered after the entry was already consumed, raises a NullPointerException inside the interceptor chain rather than being ignored.

The Apache HttpComponents 5 variant of the class, io.micrometer.core.instrument.binder.httpcomponents.hc5.MicrometerHttpClientInterceptor, carries the identical map, request interceptor and response interceptor shape, and is affected in exactly the same way on release lines that ship it.

This vulnerability was introduced in 2020 with Micrometer 1.4.0.

Mitigation

The affected 1.9.x and 1.15.x release lines are End-of-Life and will not receive community updates addressing this issue.

Users of the affected components should apply one of the following mitigations:

• Upgrade Micrometer to a currently supported release containing the fix.
• Replace the deprecated MicrometerHttpClientInterceptor with the Apache HttpComponents 5 observation instrumentation, ObservationExecChainHandler, which does not retain per-request state in a client-scoped map.
• Leverage a commercial support partner like HeroDevs for post-EOL security support.

Credits

• No individual finder is publicly credited in the upstream advisory for this vulnerability.