CVE-2026-59295 PUBLISHED

Micrometer Instrumentation of Apache HttpAsyncClient Denial of Service Vulnerability

Assigner: vmware
Reserved: 04.07.2026 Published: 24.08.2026 Updated: 24.08.2026

Micrometer-instrumented Apache HttpAsyncClient (4.x or 5.x) usage via MicrometerHttpClientInterceptor can leak memory unboundedly when asynchronous requests fail before receiving a response (e.g. connection resets or timeouts). Tracking state for these requests remains in memory indefinitely, and sustained failures lead to heap exhaustion and OutOfMemoryError crashes.

Metrics

CVSS 3.1

CVSS Vector: CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H
CVSS Score: 5.9

Attack Vector	Network	Scope	Unchanged
Attack Complexity	High	Confidentiality Impact	None
Privileges Required	None	Integrity Impact	None
User Interaction	None	Availability Impact	High

CVSS 3.1

Product Status

Vendor	VMware (Broadcom)
Product	io.micrometer:micrometer-core
Versions	affected from 0 to 1.9.18 (incl.) affected from 1.14.0 to 1.14.16 (incl.) affected from 1.15.0 to 1.15.12 (incl.) affected from 1.16.0 to 1.16.6 (incl.) Version 1.17.0 is affected Version 1.9.19 is unaffected Version 1.14.17 is unaffected Version 1.15.13 is unaffected Version 1.16.7 is unaffected Version 1.16.6.1 is unaffected Version 1.17.1 is unaffected Version 1.17.0.1 is unaffected

Workarounds

Migrate to Apache HttpClient 5.6.x's native httpclient5-observation module, or use ObservationExecChainHandler when using HttpClient 5.x with Micrometer 1.12.0+.

References

Problem Types

CWE-401: Missing Release of Memory after Effective Lifetime CWE