Security readout for executives and security teams
Plain-English summary
Micrometer, a widely used metrics library embedded in many Java and Spring applications, contains a flaw where specially crafted HTTP requests can exhaust server resources. An unauthenticated attacker over the network can trigger a denial-of-service condition, potentially knocking affected services offline. Data confidentiality and integrity are not directly impacted, but availability of dependent applications is.
Executive priority
Treat as a high-priority availability risk for any customer-facing or revenue-supporting Java service using Spring or Jetty. Schedule patching in the next standard maintenance window, and accelerate for internet-exposed workloads. No confidentiality or integrity impact, but sustained outages are plausible if left unpatched.
Technical view
CVE-2026-40984 affects Micrometer HTTP server instrumentations (micrometer-core, micrometer-jetty11, micrometer-jetty12) across the 1.9, 1.13, 1.14, 1.15, and 1.16 release lines. The weakness is classified under CWE-400 and CWE-770 (uncontrolled resource consumption / missing resource limits). CVSS 3.1 is 7.5 (AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H). Crafted HTTP requests cause resource exhaustion in the instrumentation path, producing a DoS on hosting services.
Likely exposure
Any internet- or intranet-facing Java service that bundles Micrometer HTTP server instrumentation is exposed. Spring Boot applications and Jetty-backed services in these version ranges are the most likely footprint. Exposure scales with how many services embed the vulnerable library transitively.
Exploitation context
No CISA KEV listing and no public exploitation reports are cited in the source bundle. The attack requires only network reach to the HTTP endpoint with no authentication or user interaction, which lowers the practical bar for opportunistic abuse once details circulate.
Researcher notes
CWE-400/CWE-770 point to missing bounds on resource allocation in the HTTP instrumentation path. The advisory does not disclose the specific request shape, so defenders should focus on generic DoS mitigations (timeouts, request caps, connection limits) until vendor detail is available. Confirm fixed versions directly from spring.io/security/cve-2026-40984 before staging rollout; Red Hat VEX will clarify product-level applicability.
Mitigation direction
- Upgrade Micrometer to a fixed release per the Spring security advisory for CVE-2026-40984.
- Apply Red Hat errata RHSA-2026:36839 and RHSA-2026:37390 on affected Red Hat product installations.
- Inventory Java services for transitive micrometer-core, micrometer-jetty11, and micrometer-jetty12 dependencies.
- Front exposed endpoints with rate limiting and request-size controls at the WAF or reverse proxy tier.
- Where patching lags, restrict network exposure of metrics-instrumented HTTP endpoints to trusted networks.
Validation and detection
- Query build manifests (Maven, Gradle, SBOM) for micrometer-core, micrometer-jetty11, and micrometer-jetty12 versions in scope.
- Confirm running versions via runtime metadata or /actuator endpoints after deployment.
- Cross-check Red Hat VEX (cve-2026-40984.json) for product-specific affected status.
- Monitor application logs and dashboards for abnormal thread, memory, or latency spikes on HTTP intake.
- Re-scan with your SCA tool after upgrade to confirm the vulnerable coordinates are gone.
Public sources used
Generated from the cited source records. This long-tail analysis has not been individually reviewed by a named human.
Conservative CVE-to-ATT&CK context
These mappings and lookup hints may be relevant to the vulnerability behavior, CWE, affected product, or exposure path. Glexia-inferred context is not an official MITRE, ATT&CK, CWE, or CVE Program mapping.
ATT&CK lookup starting points
Use these exact CWE pages and searches to review the Glexia ATT&CK library from this CVE's weakness and description context.
CWE-400: Exact CWE lookup
Use the exact CWE identifier as the starting point before reviewing related ATT&CK behavior. Open the exact CWE lookup page first, then review the ATT&CK searches from that MITRE weakness context. This is a Glexia lookup hint, not an official ATT&CK mapping.
Open ATT&CK lookupCWE-770: Exact CWE lookup
Use the exact CWE identifier as the starting point before reviewing related ATT&CK behavior. Open the exact CWE lookup page first, then review the ATT&CK searches from that MITRE weakness context. This is a Glexia lookup hint, not an official ATT&CK mapping.
Open ATT&CK lookupCVE-2026-40984 mapping review
Open the CVE-to-ATT&CK bridge for reviewed, inferred, or future official mappings tied to this CVE.
Open ATT&CK lookup- Severity
- High
- CVSS
- 7.5 (3.1)
- Known Exploited
- No
- Published
Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
CNA and ADP enrichment extracted from CVE v5
These fields come from the CVE record and ADP containers, not from Glexia's Take. They preserve time-varying source decisions such as CISA SSVC, KEV status, CVSS metrics, and provider references.
SSVC decision data
CVSS vector scores
2 official scoresWe collect every scored CVSS vector available in the official CNA and ADP containers. When more than one version is present, the table keeps the source vectors side by side instead of collapsing them into the highest score.
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H3.93.6vmwareCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H3.93.6redhat-SADPVulnerability scoring details
Base CVSS 3.1 score
7.5HighVector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Base CVSS 3.1 score
7.5HighVector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Vulnerability timeline
Timeline events are normalized from CVE metadata, CNA source timelines, ADP timelines, and KEV metadata when present.
- CVE reservedCVE Program
The CVE ID was reserved by the assigning CNA.
- ADP timelineredhat-SADP
Made public.
- CVE publishedCVE Program
The CVE record was published.
- ADP timelineredhat-SADP
Reported to Red Hat.
- CVE updatedCVE Program
The CVE record metadata indicates this as the latest update time.
ADP provider summaries
- 2026-06-09T05:01:51.700Z: Reported to Red Hat.
- 2026-06-09T03:47:46.447Z: Made public.
Source materials
- CVE List V5 sourceCVE List V5
- https://spring.io/security/cve-2026-40984CVE reference, vmware
- https://access.redhat.com/security/cve/CVE-2026-40984CVE reference, redhat-SADP · vdb-entry, x_refsource_REDHAT
- RHBZ#2486716CVE reference, redhat-SADP · issue-tracking, x_refsource_REDHAT
- https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-40984.jsonCVE reference, redhat-SADP · x_sadp-csaf-vex
- https://access.redhat.com/errata/RHSA-2026:36839CVE reference, redhat-SADP · vendor-advisory, x_refsource_REDHAT
- https://access.redhat.com/errata/RHSA-2026:37390CVE reference, redhat-SADP · vendor-advisory, x_refsource_REDHAT
Products and packages named in the record
CWE details
CWE links open Glexia weakness intelligence pages with official CWE context, developer remediation guidance, and related CVE mappings.
Uncontrolled Resource Consumption
Uncontrolled Resource Consumption represents a recurring weakness pattern that can create exploitable paths when design, validation, or implementation controls are missing.
Allocation of Resources Without Limits or Throttling
Allocation of Resources Without Limits or Throttling represents a recurring weakness pattern that can create exploitable paths when design, validation, or implementation controls are missing.