Vulnerability-Lookup

CVE-2026-40984 (GCVE-0-2026-40984)

Vulnerability from cvelistv5 – Published: 2026-06-09 03:47 – Updated: 2026-08-13 12:04

Title

Micrometer HTTP server instrumentations DoS vulnerability

Summary

In Micrometer, it is possible for a user to provide specially crafted HTTP requests that may cause a denial-of-service (DoS) condition. Affected versions: micrometer-core 1.16.0 through 1.16.5; 1.15.0 through 1.15.11; 1.14.0 through 1.14.15; 1.13.0 through 1.13.18; 1.9.0 through 1.9.17. micrometer-jetty11 1.16.0 through 1.16.5; 1.15.0 through 1.15.11; 1.14.0 through 1.14.15; 1.13.0 through 1.13.18. micrometer-jetty12 1.16.0 through 1.16.5; 1.15.0 through 1.15.11; 1.14.0 through 1.14.15; 1.13.0 through 1.13.18.

Severity

7.5 (High)


                        
                          CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

SSVC

Exploitation: none Automatable: yes Technical Impact: partial

CISA Coordinator · CISA-ADP (v2.0.3)

Decision recorded 2026-06-09 13:49 UTC

CWE

CWE-400 - Uncontrolled Resource Consumption
CWE-770 - Allocation of Resources Without Limits or Throttling

Assigner

vmware mitre root

References

10 references

URL	Tags
https://spring.io/security/cve-2026-40984
https://access.redhat.com/security/cve/CVE-2026-40984	vdb-entryx_refsource_REDHAT
https://bugzilla.redhat.com/show_bug.cgi?id=2486716	issue-trackingx_refsource_REDHAT
https://security.access.redhat.com/data/csaf/v2/v…	x_sadp-csaf-vex
https://access.redhat.com/errata/RHSA-2026:50849	vendor-advisoryx_refsource_REDHAT
https://access.redhat.com/errata/RHSA-2026:36839	vendor-advisoryx_refsource_REDHAT
https://access.redhat.com/errata/RHSA-2026:41951	vendor-advisoryx_refsource_REDHAT
https://access.redhat.com/errata/RHSA-2026:37390	vendor-advisoryx_refsource_REDHAT
https://access.redhat.com/errata/RHSA-2026:50848	vendor-advisoryx_refsource_REDHAT
https://access.redhat.com/errata/RHSA-2026:54435	vendor-advisoryx_refsource_REDHAT

Impacted products

26 products

Vendor	Product	Version	CPE status
Spring	Micrometer	Affected: 1.16.0 , < 1.16.5.1 (custom) Affected: 1.15.0 , < 1.15.11.1 (custom) Affected: 1.14.0 , < 1.14.16 (custom) Affected: 1.13.0 , < 1.13.19 (custom) Affected: 1.9.0 , < 1.9.18 (custom)	guessed
Spring	Micrometer	Affected: 1.16.0 , < 1.16.5.1 (custom) Affected: 1.15.0 , < 1.15.11.1 (custom) Affected: 1.14.0 , < 1.14.16 (custom) Affected: 1.13.0 , < 1.13.19 (custom)	guessed
Spring	Micrometer	Affected: 1.16.0 , < 1.16.6 (custom) Affected: 1.15.0 , < 1.15.11. (custom) Affected: 1.14.0 , < 1.14.15.1 (custom) Affected: 1.13.0 , < 1.13.19 (custom)	guessed
Red Hat	Red Hat build of Apache Camel 4.18.1.P1 for Spring Boot 3.5.16	cpe:/a:redhat:apache_camel_spring_boot:4.18
Red Hat	Red Hat Build of Apache Camel 4.18 for Quarkus 3.33	cpe:/a:redhat:apache_camel_quarkus:3.33
Red Hat	Red Hat build of Keycloak 26.6	Unaffected: 26.6.5-1 , < * (rpm) cpe:/a:redhat:build_keycloak:26.6::el9
Red Hat	Red Hat build of Keycloak 26.6	Unaffected: 26.6-11 , < * (rpm) cpe:/a:redhat:build_keycloak:26.6::el9
Red Hat	Red Hat build of Keycloak 26.6.5	cpe:/a:redhat:build_keycloak:26.6::el9
Red Hat	Red Hat build of Keycloak 26.6.5	Unaffected: rhel9-operator , < * (rpm) cpe:/a:redhat:build_keycloak:26.6::el9
Red Hat	Red Hat build of Keycloak 26.6.5	Unaffected: openshift-rhel9 , < * (rpm) cpe:/a:redhat:build_keycloak:26.6::el9
Red Hat	Red Hat Data Grid 8.6.2	cpe:/a:redhat:jboss_data_grid:8
Red Hat	Red Hat AMQ Broker 7	cpe:/a:redhat:amq_broker:7
Red Hat	Red Hat AMQ Clients	cpe:/a:redhat:amq_clients:2023
Red Hat	Red Hat build of Apache Camel 4 for Quarkus 3	cpe:/a:redhat:camel_quarkus:3
Red Hat	Red Hat build of Apache Camel - HawtIO 4	cpe:/a:redhat:apache_camel_hawtio:4
Red Hat	Red Hat build of Apicurio Registry 3	cpe:/a:redhat:apicurio_registry:3
Red Hat	Red Hat build of Debezium 3	cpe:/a:redhat:debezium:3
Red Hat	Red Hat build of OptaPlanner 8	cpe:/a:redhat:optaplanner:::el6
Red Hat	Red Hat build of Quarkus	cpe:/a:redhat:quarkus:3
Red Hat	Red Hat Fuse 7	cpe:/a:redhat:jboss_fuse:7
Red Hat	Red Hat JBoss Enterprise Application Platform Expansion Pack	cpe:/a:redhat:jbosseapxp
Red Hat	Red Hat OpenShift AI (RHOAI)	cpe:/a:redhat:openshift_ai
Red Hat	Red Hat OpenShift Dev Spaces	cpe:/a:redhat:openshift_devspaces:3
Red Hat	Red Hat Process Automation 7	cpe:/a:redhat:jboss_enterprise_bpms_platform:7
Red Hat	streams for Apache Kafka 2	cpe:/a:redhat:amq_streams:2
Red Hat	streams for Apache Kafka 3	cpe:/a:redhat:amq_streams:3

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2026-40984",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "yes"
                  },
                  {
                    "Technical Impact": "partial"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2026-06-09T13:49:55.899071Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2026-06-09T13:50:04.966Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      },
      {
        "affected": [
          {
            "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
            "cpes": [
              "cpe:/a:redhat:apache_camel_spring_boot:4.18"
            ],
            "defaultStatus": "unaffected",
            "packageName": "micrometer-core",
            "product": "Red Hat build of Apache Camel 4.18.1.P1 for Spring Boot 3.5.16",
            "vendor": "Red Hat"
          },
          {
            "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
            "cpes": [
              "cpe:/a:redhat:apache_camel_quarkus:3.33"
            ],
            "defaultStatus": "unaffected",
            "packageName": "micrometer-core",
            "product": "Red Hat Build of Apache Camel 4.18 for Quarkus 3.33",
            "vendor": "Red Hat"
          },
          {
            "collectionURL": "https://catalog.redhat.com/software/containers/",
            "cpes": [
              "cpe:/a:redhat:build_keycloak:26.6::el9"
            ],
            "defaultStatus": "affected",
            "packageName": "rhbk/keycloak-operator-bundle",
            "product": "Red Hat build of Keycloak 26.6",
            "vendor": "Red Hat",
            "versions": [
              {
                "lessThan": "*",
                "status": "unaffected",
                "version": "26.6.5-1",
                "versionType": "rpm"
              }
            ]
          },
          {
            "collectionURL": "https://catalog.redhat.com/software/containers/",
            "cpes": [
              "cpe:/a:redhat:build_keycloak:26.6::el9"
            ],
            "defaultStatus": "affected",
            "packageName": "rhbk/keycloak-rhel9",
            "product": "Red Hat build of Keycloak 26.6",
            "vendor": "Red Hat",
            "versions": [
              {
                "lessThan": "*",
                "status": "unaffected",
                "version": "26.6-11",
                "versionType": "rpm"
              }
            ]
          },
          {
            "collectionURL": "https://catalog.redhat.com/software/containers/",
            "cpes": [
              "cpe:/a:redhat:build_keycloak:26.6::el9"
            ],
            "defaultStatus": "affected",
            "packageName": "rhbk/keycloak-rhel9-operator",
            "product": "Red Hat build of Keycloak 26.6",
            "vendor": "Red Hat",
            "versions": [
              {
                "lessThan": "*",
                "status": "unaffected",
                "version": "26.6-11",
                "versionType": "rpm"
              }
            ]
          },
          {
            "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
            "cpes": [
              "cpe:/a:redhat:build_keycloak:26.6::el9"
            ],
            "defaultStatus": "unaffected",
            "packageName": "micrometer-core",
            "product": "Red Hat build of Keycloak 26.6.5",
            "vendor": "Red Hat"
          },
          {
            "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
            "cpes": [
              "cpe:/a:redhat:build_keycloak:26.6::el9"
            ],
            "defaultStatus": "unaffected",
            "packageName": "rhbk/keycloak-rhel9",
            "product": "Red Hat build of Keycloak 26.6.5",
            "vendor": "Red Hat"
          },
          {
            "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
            "cpes": [
              "cpe:/a:redhat:build_keycloak:26.6::el9"
            ],
            "defaultStatus": "affected",
            "packageName": "rhbk/keycloak",
            "product": "Red Hat build of Keycloak 26.6.5",
            "vendor": "Red Hat",
            "versions": [
              {
                "lessThan": "*",
                "status": "unaffected",
                "version": "rhel9-operator",
                "versionType": "rpm"
              }
            ]
          },
          {
            "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
            "cpes": [
              "cpe:/a:redhat:build_keycloak:26.6::el9"
            ],
            "defaultStatus": "affected",
            "packageName": "rhbk-openshift-rhel9/rhbk",
            "product": "Red Hat build of Keycloak 26.6.5",
            "vendor": "Red Hat",
            "versions": [
              {
                "lessThan": "*",
                "status": "unaffected",
                "version": "openshift-rhel9",
                "versionType": "rpm"
              }
            ]
          },
          {
            "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
            "cpes": [
              "cpe:/a:redhat:build_keycloak:26.6::el9"
            ],
            "defaultStatus": "affected",
            "packageName": "rhbk-rhel9-operator/rhbk",
            "product": "Red Hat build of Keycloak 26.6.5",
            "vendor": "Red Hat",
            "versions": [
              {
                "lessThan": "*",
                "status": "unaffected",
                "version": "rhel9-operator",
                "versionType": "rpm"
              }
            ]
          },
          {
            "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
            "cpes": [
              "cpe:/a:redhat:jboss_data_grid:8"
            ],
            "defaultStatus": "unaffected",
            "packageName": "micrometer-core",
            "product": "Red Hat Data Grid 8.6.2",
            "vendor": "Red Hat"
          },
          {
            "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
            "cpes": [
              "cpe:/a:redhat:amq_broker:7"
            ],
            "defaultStatus": "affected",
            "packageName": "micrometer-core",
            "product": "Red Hat AMQ Broker 7",
            "vendor": "Red Hat"
          },
          {
            "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
            "cpes": [
              "cpe:/a:redhat:amq_clients:2023"
            ],
            "defaultStatus": "affected",
            "packageName": "micrometer-core",
            "product": "Red Hat AMQ Clients",
            "vendor": "Red Hat"
          },
          {
            "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
            "cpes": [
              "cpe:/a:redhat:camel_quarkus:3"
            ],
            "defaultStatus": "affected",
            "packageName": "micrometer-core",
            "product": "Red Hat build of Apache Camel 4 for Quarkus 3",
            "vendor": "Red Hat"
          },
          {
            "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
            "cpes": [
              "cpe:/a:redhat:apache_camel_hawtio:4"
            ],
            "defaultStatus": "affected",
            "packageName": "micrometer-core",
            "product": "Red Hat build of Apache Camel - HawtIO 4",
            "vendor": "Red Hat"
          },
          {
            "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
            "cpes": [
              "cpe:/a:redhat:apicurio_registry:3"
            ],
            "defaultStatus": "affected",
            "packageName": "micrometer-core",
            "product": "Red Hat build of Apicurio Registry 3",
            "vendor": "Red Hat"
          },
          {
            "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
            "cpes": [
              "cpe:/a:redhat:debezium:3"
            ],
            "defaultStatus": "affected",
            "packageName": "micrometer-core",
            "product": "Red Hat build of Debezium 3",
            "vendor": "Red Hat"
          },
          {
            "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
            "cpes": [
              "cpe:/a:redhat:optaplanner:::el6"
            ],
            "defaultStatus": "affected",
            "packageName": "micrometer-core",
            "product": "Red Hat build of OptaPlanner 8",
            "vendor": "Red Hat"
          },
          {
            "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
            "cpes": [
              "cpe:/a:redhat:quarkus:3"
            ],
            "defaultStatus": "affected",
            "packageName": "micrometer-core",
            "product": "Red Hat build of Quarkus",
            "vendor": "Red Hat"
          },
          {
            "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
            "cpes": [
              "cpe:/a:redhat:jboss_fuse:7"
            ],
            "defaultStatus": "unknown",
            "packageName": "micrometer-core",
            "product": "Red Hat Fuse 7",
            "vendor": "Red Hat"
          },
          {
            "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
            "cpes": [
              "cpe:/a:redhat:jbosseapxp"
            ],
            "defaultStatus": "affected",
            "packageName": "micrometer-core",
            "product": "Red Hat JBoss Enterprise Application Platform Expansion Pack",
            "vendor": "Red Hat"
          },
          {
            "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
            "cpes": [
              "cpe:/a:redhat:openshift_ai"
            ],
            "defaultStatus": "unaffected",
            "packageName": "rhoai/odh-trustyai-service-rhel9",
            "product": "Red Hat OpenShift AI (RHOAI)",
            "vendor": "Red Hat"
          },
          {
            "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
            "cpes": [
              "cpe:/a:redhat:openshift_devspaces:3"
            ],
            "defaultStatus": "affected",
            "packageName": "devspaces/openvsx-rhel9",
            "product": "Red Hat OpenShift Dev Spaces",
            "vendor": "Red Hat"
          },
          {
            "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
            "cpes": [
              "cpe:/a:redhat:openshift_devspaces:3"
            ],
            "defaultStatus": "affected",
            "packageName": "devspaces/pluginregistry-rhel9",
            "product": "Red Hat OpenShift Dev Spaces",
            "vendor": "Red Hat"
          },
          {
            "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
            "cpes": [
              "cpe:/a:redhat:openshift_devspaces:3"
            ],
            "defaultStatus": "unknown",
            "packageName": "devspaces/server-rhel9",
            "product": "Red Hat OpenShift Dev Spaces",
            "vendor": "Red Hat"
          },
          {
            "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
            "cpes": [
              "cpe:/a:redhat:jboss_enterprise_bpms_platform:7"
            ],
            "defaultStatus": "affected",
            "packageName": "micrometer-core",
            "product": "Red Hat Process Automation 7",
            "vendor": "Red Hat"
          },
          {
            "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
            "cpes": [
              "cpe:/a:redhat:amq_streams:2"
            ],
            "defaultStatus": "affected",
            "packageName": "micrometer-core",
            "product": "streams for Apache Kafka 2",
            "vendor": "Red Hat"
          },
          {
            "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
            "cpes": [
              "cpe:/a:redhat:amq_streams:3"
            ],
            "defaultStatus": "affected",
            "packageName": "micrometer-core",
            "product": "streams for Apache Kafka 3",
            "vendor": "Red Hat"
          }
        ],
        "datePublic": "2026-06-09T03:47:46.447Z",
        "descriptions": [
          {
            "lang": "en",
            "value": "A flaw was found in Micrometer. A remote attacker can provide specially crafted HTTP requests, which may lead to a denial-of-service (DoS) condition. This vulnerability allows an attacker to disrupt the availability of the affected system."
          }
        ],
        "metrics": [
          {
            "other": {
              "content": {
                "namespace": "https://access.redhat.com/security/updates/classification/",
                "value": "Important"
              },
              "type": "Red Hat severity rating"
            }
          },
          {
            "cvssV3_1": {
              "attackComplexity": "LOW",
              "attackVector": "NETWORK",
              "availabilityImpact": "HIGH",
              "baseScore": 7.5,
              "baseSeverity": "HIGH",
              "confidentialityImpact": "NONE",
              "integrityImpact": "NONE",
              "privilegesRequired": "NONE",
              "scope": "UNCHANGED",
              "userInteraction": "NONE",
              "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
              "version": "3.1"
            },
            "format": "CVSS"
          }
        ],
        "problemTypes": [
          {
            "descriptions": [
              {
                "cweId": "CWE-770",
                "description": "Allocation of Resources Without Limits or Throttling",
                "lang": "en",
                "type": "CWE"
              }
            ]
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2026-08-13T12:04:30.875Z",
          "orgId": "0b0ca135-0b70-47e7-9f44-1890c2a1c46c",
          "shortName": "redhat-SADP"
        },
        "references": [
          {
            "tags": [
              "vdb-entry",
              "x_refsource_REDHAT"
            ],
            "url": "https://access.redhat.com/security/cve/CVE-2026-40984"
          },
          {
            "name": "RHBZ#2486716",
            "tags": [
              "issue-tracking",
              "x_refsource_REDHAT"
            ],
            "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2486716"
          },
          {
            "tags": [
              "x_sadp-csaf-vex"
            ],
            "url": "https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-40984.json"
          },
          {
            "tags": [
              "vendor-advisory",
              "x_refsource_REDHAT"
            ],
            "url": "https://access.redhat.com/errata/RHSA-2026:50849"
          },
          {
            "tags": [
              "vendor-advisory",
              "x_refsource_REDHAT"
            ],
            "url": "https://access.redhat.com/errata/RHSA-2026:36839"
          },
          {
            "tags": [
              "vendor-advisory",
              "x_refsource_REDHAT"
            ],
            "url": "https://access.redhat.com/errata/RHSA-2026:41951"
          },
          {
            "tags": [
              "vendor-advisory",
              "x_refsource_REDHAT"
            ],
            "url": "https://access.redhat.com/errata/RHSA-2026:37390"
          },
          {
            "tags": [
              "vendor-advisory",
              "x_refsource_REDHAT"
            ],
            "url": "https://access.redhat.com/errata/RHSA-2026:50848"
          },
          {
            "tags": [
              "vendor-advisory",
              "x_refsource_REDHAT"
            ],
            "url": "https://access.redhat.com/errata/RHSA-2026:54435"
          }
        ],
        "solutions": [
          {
            "lang": "en",
            "value": "RHSA-2026:50849: Red Hat build of Keycloak 26.6"
          },
          {
            "lang": "en",
            "value": "RHSA-2026:36839: Red Hat Build of Apache Camel 4.18 for Quarkus 3.33"
          },
          {
            "lang": "en",
            "value": "RHSA-2026:41951: Red Hat Data Grid 8.6.2"
          },
          {
            "lang": "en",
            "value": "RHSA-2026:37390: Red Hat build of Apache Camel 4.18.1.P1 for Spring Boot 3.5.16"
          },
          {
            "lang": "en",
            "value": "RHSA-2026:50848: Red Hat build of Keycloak 26.6.5"
          },
          {
            "lang": "en",
            "value": "RHSA-2026:54435: Streams for Apache Kafka 3.2.1"
          }
        ],
        "timeline": [
          {
            "lang": "en",
            "time": "2026-06-09T05:01:51.700Z",
            "value": "Reported to Red Hat."
          },
          {
            "lang": "en",
            "time": "2026-06-09T03:47:46.447Z",
            "value": "Made public."
          }
        ],
        "title": "micrometer-core: micrometer-jetty11: micrometer-jetty12: Micrometer: Denial of Service via specially crafted HTTP requests",
        "x_adpType": "supplier",
        "x_generator": {
          "engine": "sadp-cli 1.0.0"
        }
      }
    ],
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "packageName": "micrometer-core",
          "product": "Micrometer",
          "vendor": "Spring",
          "versions": [
            {
              "lessThan": "1.16.5.1",
              "status": "affected",
              "version": "1.16.0",
              "versionType": "custom"
            },
            {
              "lessThan": "1.15.11.1",
              "status": "affected",
              "version": "1.15.0",
              "versionType": "custom"
            },
            {
              "lessThan": "1.14.16",
              "status": "affected",
              "version": "1.14.0",
              "versionType": "custom"
            },
            {
              "lessThan": "1.13.19",
              "status": "affected",
              "version": "1.13.0",
              "versionType": "custom"
            },
            {
              "lessThan": "1.9.18",
              "status": "affected",
              "version": "1.9.0",
              "versionType": "custom"
            }
          ]
        },
        {
          "defaultStatus": "unaffected",
          "packageName": "micrometer-jetty11",
          "product": "Micrometer",
          "vendor": "Spring",
          "versions": [
            {
              "lessThan": "1.16.5.1",
              "status": "affected",
              "version": "1.16.0",
              "versionType": "custom"
            },
            {
              "lessThan": "1.15.11.1",
              "status": "affected",
              "version": "1.15.0",
              "versionType": "custom"
            },
            {
              "lessThan": "1.14.16",
              "status": "affected",
              "version": "1.14.0",
              "versionType": "custom"
            },
            {
              "lessThan": "1.13.19",
              "status": "affected",
              "version": "1.13.0",
              "versionType": "custom"
            }
          ]
        },
        {
          "defaultStatus": "unaffected",
          "packageName": "micrometer-jetty12",
          "product": "Micrometer",
          "vendor": "Spring",
          "versions": [
            {
              "lessThan": "1.16.6",
              "status": "affected",
              "version": "1.16.0",
              "versionType": "custom"
            },
            {
              "lessThan": "1.15.11.",
              "status": "affected",
              "version": "1.15.0",
              "versionType": "custom"
            },
            {
              "lessThan": "1.14.15.1",
              "status": "affected",
              "version": "1.14.0",
              "versionType": "custom"
            },
            {
              "lessThan": "1.13.19",
              "status": "affected",
              "version": "1.13.0",
              "versionType": "custom"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "supportingMedia": [
            {
              "base64": false,
              "type": "text/html",
              "value": "In Micrometer, it is possible for a user to provide specially crafted HTTP requests that may cause a denial-of-service (DoS) condition.\n\nAffected versions:\nmicrometer-core 1.16.0 through 1.16.5; 1.15.0 through 1.15.11; 1.14.0 through 1.14.15; 1.13.0 through 1.13.18; 1.9.0 through 1.9.17.\nmicrometer-jetty11 1.16.0 through 1.16.5; 1.15.0 through 1.15.11; 1.14.0 through 1.14.15; 1.13.0 through 1.13.18.\nmicrometer-jetty12 1.16.0 through 1.16.5; 1.15.0 through 1.15.11; 1.14.0 through 1.14.15; 1.13.0 through 1.13.18."
            }
          ],
          "value": "In Micrometer, it is possible for a user to provide specially crafted HTTP requests that may cause a denial-of-service (DoS) condition.\n\nAffected versions:\nmicrometer-core 1.16.0 through 1.16.5; 1.15.0 through 1.15.11; 1.14.0 through 1.14.15; 1.13.0 through 1.13.18; 1.9.0 through 1.9.17.\nmicrometer-jetty11 1.16.0 through 1.16.5; 1.15.0 through 1.15.11; 1.14.0 through 1.14.15; 1.13.0 through 1.13.18.\nmicrometer-jetty12 1.16.0 through 1.16.5; 1.15.0 through 1.15.11; 1.14.0 through 1.14.15; 1.13.0 through 1.13.18."
        }
      ],
      "impacts": [
        {
          "descriptions": [
            {
              "lang": "en",
              "value": "An unauthenticated remote attacker can cause denial of service by sending specially crafted HTTP requests that trigger excessive resource consumption in applications using Micrometer HTTP server instrumentations."
            }
          ]
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "attackComplexity": "LOW",
            "attackVector": "NETWORK",
            "availabilityImpact": "HIGH",
            "baseScore": 7.5,
            "baseSeverity": "HIGH",
            "confidentialityImpact": "NONE",
            "integrityImpact": "NONE",
            "privilegesRequired": "NONE",
            "scope": "UNCHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
            "version": "3.1"
          },
          "format": "CVSS",
          "scenarios": [
            {
              "lang": "en",
              "value": "GENERAL"
            }
          ]
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-400",
              "description": "CWE-400: Uncontrolled Resource Consumption",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-06-23T20:06:22.279Z",
        "orgId": "dcf2e128-44bd-42ed-91e8-88f912c1401d",
        "shortName": "vmware"
      },
      "references": [
        {
          "url": "https://spring.io/security/cve-2026-40984"
        }
      ],
      "source": {
        "discovery": "UNKNOWN"
      },
      "title": "Micrometer HTTP server instrumentations DoS vulnerability",
      "x_generator": {
        "engine": "Vulnogram 1.0.1"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "dcf2e128-44bd-42ed-91e8-88f912c1401d",
    "assignerShortName": "vmware",
    "cveId": "CVE-2026-40984",
    "datePublished": "2026-06-09T03:47:46.447Z",
    "dateReserved": "2026-04-16T02:19:09.388Z",
    "dateUpdated": "2026-08-13T12:04:30.875Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2",
  "vulnerability-lookup:meta": {
    "epss": {
      "cve": "CVE-2026-40984",
      "date": "2026-08-19",
      "epss": "0.00773",
      "percentile": "0.52874"
    },
    "nvd": "{\"cve\":{\"id\":\"CVE-2026-40984\",\"sourceIdentifier\":\"security@vmware.com\",\"published\":\"2026-06-09T05:16:34.780\",\"lastModified\":\"2026-08-13T13:18:47.123\",\"vulnStatus\":\"Awaiting Analysis\",\"cveTags\":[],\"descriptions\":[{\"lang\":\"en\",\"value\":\"In Micrometer, it is possible for a user to provide specially crafted HTTP requests that may cause a denial-of-service (DoS) condition.\\n\\nAffected versions:\\nmicrometer-core 1.16.0 through 1.16.5; 1.15.0 through 1.15.11; 1.14.0 through 1.14.15; 1.13.0 through 1.13.18; 1.9.0 through 1.9.17.\\nmicrometer-jetty11 1.16.0 through 1.16.5; 1.15.0 through 1.15.11; 1.14.0 through 1.14.15; 1.13.0 through 1.13.18.\\nmicrometer-jetty12 1.16.0 through 1.16.5; 1.15.0 through 1.15.11; 1.14.0 through 1.14.15; 1.13.0 through 1.13.18.\"},{\"lang\":\"es\",\"value\":\"En Micrometer, es posible que un usuario proporcione solicitudes HTTP especialmente dise\u00f1adas que pueden causar una condici\u00f3n de denegaci\u00f3n de servicio (DoS).\\n\\nVersiones afectadas:\\nmicrometer-core 1.16.0 a 1.16.5; 1.15.0 a 1.15.11; 1.14.0 a 1.14.15; 1.13.0 a 1.13.18; 1.9.0 a 1.9.17.\\nmicrometer-jetty11 1.16.0 a 1.16.5; 1.15.0 a 1.15.11; 1.14.0 a 1.14.15; 1.13.0 a 1.13.18.\\nmicrometer-jetty12 1.16.0 a 1.16.5; 1.15.0 a 1.15.11; 1.14.0 a 1.14.15; 1.13.0 a 1.13.18.\"}],\"affected\":[{\"source\":\"security@vmware.com\",\"affectedData\":[{\"vendor\":\"Spring\",\"product\":\"Micrometer\",\"defaultStatus\":\"unaffected\",\"packageName\":\"micrometer-core\",\"versions\":[{\"version\":\"1.16.0\",\"lessThan\":\"1.16.5.1\",\"versionType\":\"custom\",\"status\":\"affected\"},{\"version\":\"1.15.0\",\"lessThan\":\"1.15.11.1\",\"versionType\":\"custom\",\"status\":\"affected\"},{\"version\":\"1.14.0\",\"lessThan\":\"1.14.16\",\"versionType\":\"custom\",\"status\":\"affected\"},{\"version\":\"1.13.0\",\"lessThan\":\"1.13.19\",\"versionType\":\"custom\",\"status\":\"affected\"},{\"version\":\"1.9.0\",\"lessThan\":\"1.9.18\",\"versionType\":\"custom\",\"status\":\"affected\"}]},{\"vendor\":\"Spring\",\"product\":\"Micrometer\",\"defaultStatus\":\"unaffected\",\"packageName\":\"micrometer-jetty11\",\"versions\":[{\"version\":\"1.16.0\",\"lessThan\":\"1.16.5.1\",\"versionType\":\"custom\",\"status\":\"affected\"},{\"version\":\"1.15.0\",\"lessThan\":\"1.15.11.1\",\"versionType\":\"custom\",\"status\":\"affected\"},{\"version\":\"1.14.0\",\"lessThan\":\"1.14.16\",\"versionType\":\"custom\",\"status\":\"affected\"},{\"version\":\"1.13.0\",\"lessThan\":\"1.13.19\",\"versionType\":\"custom\",\"status\":\"affected\"}]},{\"vendor\":\"Spring\",\"product\":\"Micrometer\",\"defaultStatus\":\"unaffected\",\"packageName\":\"micrometer-jetty12\",\"versions\":[{\"version\":\"1.16.0\",\"lessThan\":\"1.16.6\",\"versionType\":\"custom\",\"status\":\"affected\"},{\"version\":\"1.15.0\",\"lessThan\":\"1.15.11.\",\"versionType\":\"custom\",\"status\":\"affected\"},{\"version\":\"1.14.0\",\"lessThan\":\"1.14.15.1\",\"versionType\":\"custom\",\"status\":\"affected\"},{\"version\":\"1.13.0\",\"lessThan\":\"1.13.19\",\"versionType\":\"custom\",\"status\":\"affected\"}]}]},{\"source\":\"0b0ca135-0b70-47e7-9f44-1890c2a1c46c\",\"affectedData\":[{\"vendor\":\"Red Hat\",\"product\":\"Red Hat build of Apache Camel 4.18.1.P1 for Spring Boot 3.5.16\",\"defaultStatus\":\"unaffected\",\"collectionURL\":\"https://access.redhat.com/downloads/content/package-browser/\",\"packageName\":\"micrometer-core\",\"cpes\":[\"cpe:/a:redhat:apache_camel_spring_boot:4.18\"]},{\"vendor\":\"Red Hat\",\"product\":\"Red Hat Build of Apache Camel 4.18 for Quarkus 3.33\",\"defaultStatus\":\"unaffected\",\"collectionURL\":\"https://access.redhat.com/downloads/content/package-browser/\",\"packageName\":\"micrometer-core\",\"cpes\":[\"cpe:/a:redhat:apache_camel_quarkus:3.33\"]},{\"vendor\":\"Red Hat\",\"product\":\"Red Hat build of Keycloak 26.6\",\"defaultStatus\":\"affected\",\"collectionURL\":\"https://catalog.redhat.com/software/containers/\",\"packageName\":\"rhbk/keycloak-operator-bundle\",\"cpes\":[\"cpe:/a:redhat:build_keycloak:26.6::el9\"],\"versions\":[{\"version\":\"26.6.5-1\",\"lessThan\":\"*\",\"versionType\":\"rpm\",\"status\":\"unaffected\"}]},{\"vendor\":\"Red Hat\",\"product\":\"Red Hat build of Keycloak 26.6\",\"defaultStatus\":\"affected\",\"collectionURL\":\"https://catalog.redhat.com/software/containers/\",\"packageName\":\"rhbk/keycloak-rhel9\",\"cpes\":[\"cpe:/a:redhat:build_keycloak:26.6::el9\"],\"versions\":[{\"version\":\"26.6-11\",\"lessThan\":\"*\",\"versionType\":\"rpm\",\"status\":\"unaffected\"}]},{\"vendor\":\"Red Hat\",\"product\":\"Red Hat build of Keycloak 26.6\",\"defaultStatus\":\"affected\",\"collectionURL\":\"https://catalog.redhat.com/software/containers/\",\"packageName\":\"rhbk/keycloak-rhel9-operator\",\"cpes\":[\"cpe:/a:redhat:build_keycloak:26.6::el9\"],\"versions\":[{\"version\":\"26.6-11\",\"lessThan\":\"*\",\"versionType\":\"rpm\",\"status\":\"unaffected\"}]},{\"vendor\":\"Red Hat\",\"product\":\"Red Hat build of Keycloak 26.6.5\",\"defaultStatus\":\"unaffected\",\"collectionURL\":\"https://access.redhat.com/downloads/content/package-browser/\",\"packageName\":\"micrometer-core\",\"cpes\":[\"cpe:/a:redhat:build_keycloak:26.6::el9\"]},{\"vendor\":\"Red Hat\",\"product\":\"Red Hat build of Keycloak 26.6.5\",\"defaultStatus\":\"unaffected\",\"collectionURL\":\"https://access.redhat.com/downloads/content/package-browser/\",\"packageName\":\"rhbk/keycloak-rhel9\",\"cpes\":[\"cpe:/a:redhat:build_keycloak:26.6::el9\"]},{\"vendor\":\"Red Hat\",\"product\":\"Red Hat build of Keycloak 26.6.5\",\"defaultStatus\":\"affected\",\"collectionURL\":\"https://access.redhat.com/downloads/content/package-browser/\",\"packageName\":\"rhbk/keycloak\",\"cpes\":[\"cpe:/a:redhat:build_keycloak:26.6::el9\"],\"versions\":[{\"version\":\"rhel9-operator\",\"lessThan\":\"*\",\"versionType\":\"rpm\",\"status\":\"unaffected\"}]},{\"vendor\":\"Red Hat\",\"product\":\"Red Hat build of Keycloak 26.6.5\",\"defaultStatus\":\"affected\",\"collectionURL\":\"https://access.redhat.com/downloads/content/package-browser/\",\"packageName\":\"rhbk-openshift-rhel9/rhbk\",\"cpes\":[\"cpe:/a:redhat:build_keycloak:26.6::el9\"],\"versions\":[{\"version\":\"openshift-rhel9\",\"lessThan\":\"*\",\"versionType\":\"rpm\",\"status\":\"unaffected\"}]},{\"vendor\":\"Red Hat\",\"product\":\"Red Hat build of Keycloak 26.6.5\",\"defaultStatus\":\"affected\",\"collectionURL\":\"https://access.redhat.com/downloads/content/package-browser/\",\"packageName\":\"rhbk-rhel9-operator/rhbk\",\"cpes\":[\"cpe:/a:redhat:build_keycloak:26.6::el9\"],\"versions\":[{\"version\":\"rhel9-operator\",\"lessThan\":\"*\",\"versionType\":\"rpm\",\"status\":\"unaffected\"}]},{\"vendor\":\"Red Hat\",\"product\":\"Red Hat Data Grid 8.6.2\",\"defaultStatus\":\"unaffected\",\"collectionURL\":\"https://access.redhat.com/downloads/content/package-browser/\",\"packageName\":\"micrometer-core\",\"cpes\":[\"cpe:/a:redhat:jboss_data_grid:8\"]},{\"vendor\":\"Red Hat\",\"product\":\"Red Hat AMQ Broker 7\",\"defaultStatus\":\"affected\",\"collectionURL\":\"https://access.redhat.com/downloads/content/package-browser/\",\"packageName\":\"micrometer-core\",\"cpes\":[\"cpe:/a:redhat:amq_broker:7\"]},{\"vendor\":\"Red Hat\",\"product\":\"Red Hat AMQ Clients\",\"defaultStatus\":\"affected\",\"collectionURL\":\"https://access.redhat.com/downloads/content/package-browser/\",\"packageName\":\"micrometer-core\",\"cpes\":[\"cpe:/a:redhat:amq_clients:2023\"]},{\"vendor\":\"Red Hat\",\"product\":\"Red Hat build of Apache Camel 4 for Quarkus 3\",\"defaultStatus\":\"affected\",\"collectionURL\":\"https://access.redhat.com/downloads/content/package-browser/\",\"packageName\":\"micrometer-core\",\"cpes\":[\"cpe:/a:redhat:camel_quarkus:3\"]},{\"vendor\":\"Red Hat\",\"product\":\"Red Hat build of Apache Camel - HawtIO 4\",\"defaultStatus\":\"affected\",\"collectionURL\":\"https://access.redhat.com/downloads/content/package-browser/\",\"packageName\":\"micrometer-core\",\"cpes\":[\"cpe:/a:redhat:apache_camel_hawtio:4\"]},{\"vendor\":\"Red Hat\",\"product\":\"Red Hat build of Apicurio Registry 3\",\"defaultStatus\":\"affected\",\"collectionURL\":\"https://access.redhat.com/downloads/content/package-browser/\",\"packageName\":\"micrometer-core\",\"cpes\":[\"cpe:/a:redhat:apicurio_registry:3\"]},{\"vendor\":\"Red Hat\",\"product\":\"Red Hat build of Debezium 3\",\"defaultStatus\":\"affected\",\"collectionURL\":\"https://access.redhat.com/downloads/content/package-browser/\",\"packageName\":\"micrometer-core\",\"cpes\":[\"cpe:/a:redhat:debezium:3\"]},{\"vendor\":\"Red Hat\",\"product\":\"Red Hat build of OptaPlanner 8\",\"defaultStatus\":\"affected\",\"collectionURL\":\"https://access.redhat.com/downloads/content/package-browser/\",\"packageName\":\"micrometer-core\",\"cpes\":[\"cpe:/a:redhat:optaplanner:::el6\"]},{\"vendor\":\"Red Hat\",\"product\":\"Red Hat build of Quarkus\",\"defaultStatus\":\"affected\",\"collectionURL\":\"https://access.redhat.com/downloads/content/package-browser/\",\"packageName\":\"micrometer-core\",\"cpes\":[\"cpe:/a:redhat:quarkus:3\"]},{\"vendor\":\"Red Hat\",\"product\":\"Red Hat Fuse 7\",\"defaultStatus\":\"unknown\",\"collectionURL\":\"https://access.redhat.com/downloads/content/package-browser/\",\"packageName\":\"micrometer-core\",\"cpes\":[\"cpe:/a:redhat:jboss_fuse:7\"]},{\"vendor\":\"Red Hat\",\"product\":\"Red Hat JBoss Enterprise Application Platform Expansion Pack\",\"defaultStatus\":\"affected\",\"collectionURL\":\"https://access.redhat.com/downloads/content/package-browser/\",\"packageName\":\"micrometer-core\",\"cpes\":[\"cpe:/a:redhat:jbosseapxp\"]},{\"vendor\":\"Red Hat\",\"product\":\"Red Hat OpenShift AI (RHOAI)\",\"defaultStatus\":\"unaffected\",\"collectionURL\":\"https://access.redhat.com/downloads/content/package-browser/\",\"packageName\":\"rhoai/odh-trustyai-service-rhel9\",\"cpes\":[\"cpe:/a:redhat:openshift_ai\"]},{\"vendor\":\"Red Hat\",\"product\":\"Red Hat OpenShift Dev Spaces\",\"defaultStatus\":\"affected\",\"collectionURL\":\"https://access.redhat.com/downloads/content/package-browser/\",\"packageName\":\"devspaces/openvsx-rhel9\",\"cpes\":[\"cpe:/a:redhat:openshift_devspaces:3\"]},{\"vendor\":\"Red Hat\",\"product\":\"Red Hat OpenShift Dev Spaces\",\"defaultStatus\":\"affected\",\"collectionURL\":\"https://access.redhat.com/downloads/content/package-browser/\",\"packageName\":\"devspaces/pluginregistry-rhel9\",\"cpes\":[\"cpe:/a:redhat:openshift_devspaces:3\"]},{\"vendor\":\"Red Hat\",\"product\":\"Red Hat OpenShift Dev Spaces\",\"defaultStatus\":\"unknown\",\"collectionURL\":\"https://access.redhat.com/downloads/content/package-browser/\",\"packageName\":\"devspaces/server-rhel9\",\"cpes\":[\"cpe:/a:redhat:openshift_devspaces:3\"]},{\"vendor\":\"Red Hat\",\"product\":\"Red Hat Process Automation 7\",\"defaultStatus\":\"affected\",\"collectionURL\":\"https://access.redhat.com/downloads/content/package-browser/\",\"packageName\":\"micrometer-core\",\"cpes\":[\"cpe:/a:redhat:jboss_enterprise_bpms_platform:7\"]},{\"vendor\":\"Red Hat\",\"product\":\"streams for Apache Kafka 2\",\"defaultStatus\":\"affected\",\"collectionURL\":\"https://access.redhat.com/downloads/content/package-browser/\",\"packageName\":\"micrometer-core\",\"cpes\":[\"cpe:/a:redhat:amq_streams:2\"]},{\"vendor\":\"Red Hat\",\"product\":\"streams for Apache Kafka 3\",\"defaultStatus\":\"affected\",\"collectionURL\":\"https://access.redhat.com/downloads/content/package-browser/\",\"packageName\":\"micrometer-core\",\"cpes\":[\"cpe:/a:redhat:amq_streams:3\"]}]}],\"metrics\":{\"cvssMetricV31\":[{\"source\":\"security@vmware.com\",\"type\":\"Secondary\",\"cvssData\":{\"version\":\"3.1\",\"vectorString\":\"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H\",\"baseScore\":7.5,\"baseSeverity\":\"HIGH\",\"attackVector\":\"NETWORK\",\"attackComplexity\":\"LOW\",\"privilegesRequired\":\"NONE\",\"userInteraction\":\"NONE\",\"scope\":\"UNCHANGED\",\"confidentialityImpact\":\"NONE\",\"integrityImpact\":\"NONE\",\"availabilityImpact\":\"HIGH\"},\"exploitabilityScore\":3.9,\"impactScore\":3.6},{\"source\":\"0b0ca135-0b70-47e7-9f44-1890c2a1c46c\",\"type\":\"Secondary\",\"cvssData\":{\"version\":\"3.1\",\"vectorString\":\"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H\",\"baseScore\":7.5,\"baseSeverity\":\"HIGH\",\"attackVector\":\"NETWORK\",\"attackComplexity\":\"LOW\",\"privilegesRequired\":\"NONE\",\"userInteraction\":\"NONE\",\"scope\":\"UNCHANGED\",\"confidentialityImpact\":\"NONE\",\"integrityImpact\":\"NONE\",\"availabilityImpact\":\"HIGH\"},\"exploitabilityScore\":3.9,\"impactScore\":3.6}],\"ssvcV203\":[{\"source\":\"134c704f-9b21-4f2e-91b3-4a467353bcc0\",\"ssvcData\":{\"timestamp\":\"2026-06-09T13:49:55.899071Z\",\"id\":\"CVE-2026-40984\",\"options\":[{\"exploitation\":\"none\"},{\"automatable\":\"yes\"},{\"technicalImpact\":\"partial\"}],\"role\":\"CISA Coordinator\",\"version\":\"2.0.3\"}}]},\"weaknesses\":[{\"source\":\"security@vmware.com\",\"type\":\"Secondary\",\"description\":[{\"lang\":\"en\",\"value\":\"CWE-400\"}]},{\"source\":\"0b0ca135-0b70-47e7-9f44-1890c2a1c46c\",\"type\":\"Secondary\",\"description\":[{\"lang\":\"en\",\"value\":\"CWE-770\"}]}],\"references\":[{\"url\":\"https://spring.io/security/cve-2026-40984\",\"source\":\"security@vmware.com\"},{\"url\":\"https://access.redhat.com/errata/RHSA-2026:36839\",\"source\":\"0b0ca135-0b70-47e7-9f44-1890c2a1c46c\"},{\"url\":\"https://access.redhat.com/errata/RHSA-2026:37390\",\"source\":\"0b0ca135-0b70-47e7-9f44-1890c2a1c46c\"},{\"url\":\"https://access.redhat.com/errata/RHSA-2026:41951\",\"source\":\"0b0ca135-0b70-47e7-9f44-1890c2a1c46c\"},{\"url\":\"https://access.redhat.com/errata/RHSA-2026:50848\",\"source\":\"0b0ca135-0b70-47e7-9f44-1890c2a1c46c\"},{\"url\":\"https://access.redhat.com/errata/RHSA-2026:50849\",\"source\":\"0b0ca135-0b70-47e7-9f44-1890c2a1c46c\"},{\"url\":\"https://access.redhat.com/errata/RHSA-2026:54435\",\"source\":\"0b0ca135-0b70-47e7-9f44-1890c2a1c46c\"},{\"url\":\"https://access.redhat.com/security/cve/CVE-2026-40984\",\"source\":\"0b0ca135-0b70-47e7-9f44-1890c2a1c46c\"},{\"url\":\"https://bugzilla.redhat.com/show_bug.cgi?id=2486716\",\"source\":\"0b0ca135-0b70-47e7-9f44-1890c2a1c46c\"},{\"url\":\"https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-40984.json\",\"source\":\"0b0ca135-0b70-47e7-9f44-1890c2a1c46c\"}]}}",
    "redhat_vex": {
      "aggregate_severity": "Important",
      "current_release_date": "2026-08-12T19:39:22+00:00",
      "cve": "CVE-2026-40984",
      "id": "CVE-2026-40984",
      "initial_release_date": "2026-06-09T03:47:46.447000+00:00",
      "product_status:fixed": "14",
      "product_status:known_affected": "15",
      "product_status:known_not_affected": "1",
      "source": "Red Hat CSAF VEX",
      "status": "final",
      "title": "micrometer-core: micrometer-jetty11: micrometer-jetty12: Micrometer: Denial of Service via specially crafted HTTP requests",
      "url": "https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-40984.json",
      "version": "3"
    },
    "vulnrichment": {
      "containers": "{\"adp\": [{\"title\": \"micrometer-core: micrometer-jetty11: micrometer-jetty12: Micrometer: Denial of Service via specially crafted HTTP requests\", \"metrics\": [{\"other\": {\"type\": \"Red Hat severity rating\", \"content\": {\"value\": \"Important\", \"namespace\": \"https://access.redhat.com/security/updates/classification/\"}}}, {\"format\": \"CVSS\", \"cvssV3_1\": {\"scope\": \"UNCHANGED\", \"version\": \"3.1\", \"baseScore\": 7.5, \"attackVector\": \"NETWORK\", \"baseSeverity\": \"HIGH\", \"vectorString\": \"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H\", \"integrityImpact\": \"NONE\", \"userInteraction\": \"NONE\", \"attackComplexity\": \"LOW\", \"availabilityImpact\": \"HIGH\", \"privilegesRequired\": \"NONE\", \"confidentialityImpact\": \"NONE\"}}], \"affected\": [{\"cpes\": [\"cpe:/a:redhat:apache_camel_spring_boot:4.18\"], \"vendor\": \"Red Hat\", \"product\": \"Red Hat build of Apache Camel 4.18.1.P1 for Spring Boot 3.5.16\", \"packageName\": \"micrometer-core\", \"collectionURL\": \"https://access.redhat.com/downloads/content/package-browser/\", \"defaultStatus\": \"unaffected\"}, {\"cpes\": [\"cpe:/a:redhat:apache_camel_quarkus:3.33\"], \"vendor\": \"Red Hat\", \"product\": \"Red Hat Build of Apache Camel 4.18 for Quarkus 3.33\", \"packageName\": \"micrometer-core\", \"collectionURL\": \"https://access.redhat.com/downloads/content/package-browser/\", \"defaultStatus\": \"unaffected\"}, {\"cpes\": [\"cpe:/a:redhat:build_keycloak:26.6::el9\"], \"vendor\": \"Red Hat\", \"product\": \"Red Hat build of Keycloak 26.6\", \"versions\": [{\"status\": \"unaffected\", \"version\": \"26.6.5-1\", \"lessThan\": \"*\", \"versionType\": \"rpm\"}], \"packageName\": \"rhbk/keycloak-operator-bundle\", \"collectionURL\": \"https://catalog.redhat.com/software/containers/\", \"defaultStatus\": \"affected\"}, {\"cpes\": [\"cpe:/a:redhat:build_keycloak:26.6::el9\"], \"vendor\": \"Red Hat\", \"product\": \"Red Hat build of Keycloak 26.6\", \"versions\": [{\"status\": \"unaffected\", \"version\": \"26.6-11\", \"lessThan\": \"*\", \"versionType\": \"rpm\"}], \"packageName\": \"rhbk/keycloak-rhel9\", \"collectionURL\": \"https://catalog.redhat.com/software/containers/\", \"defaultStatus\": \"affected\"}, {\"cpes\": [\"cpe:/a:redhat:build_keycloak:26.6::el9\"], \"vendor\": \"Red Hat\", \"product\": \"Red Hat build of Keycloak 26.6\", \"versions\": [{\"status\": \"unaffected\", \"version\": \"26.6-11\", \"lessThan\": \"*\", \"versionType\": \"rpm\"}], \"packageName\": \"rhbk/keycloak-rhel9-operator\", \"collectionURL\": \"https://catalog.redhat.com/software/containers/\", \"defaultStatus\": \"affected\"}, {\"cpes\": [\"cpe:/a:redhat:build_keycloak:26.6::el9\"], \"vendor\": \"Red Hat\", \"product\": \"Red Hat build of Keycloak 26.6.5\", \"packageName\": \"micrometer-core\", \"collectionURL\": \"https://access.redhat.com/downloads/content/package-browser/\", \"defaultStatus\": \"unaffected\"}, {\"cpes\": [\"cpe:/a:redhat:build_keycloak:26.6::el9\"], \"vendor\": \"Red Hat\", \"product\": \"Red Hat build of Keycloak 26.6.5\", \"packageName\": \"rhbk/keycloak-rhel9\", \"collectionURL\": \"https://access.redhat.com/downloads/content/package-browser/\", \"defaultStatus\": \"unaffected\"}, {\"cpes\": [\"cpe:/a:redhat:build_keycloak:26.6::el9\"], \"vendor\": \"Red Hat\", \"product\": \"Red Hat build of Keycloak 26.6.5\", \"versions\": [{\"status\": \"unaffected\", \"version\": \"rhel9-operator\", \"lessThan\": \"*\", \"versionType\": \"rpm\"}], \"packageName\": \"rhbk/keycloak\", \"collectionURL\": \"https://access.redhat.com/downloads/content/package-browser/\", \"defaultStatus\": \"affected\"}, {\"cpes\": [\"cpe:/a:redhat:build_keycloak:26.6::el9\"], \"vendor\": \"Red Hat\", \"product\": \"Red Hat build of Keycloak 26.6.5\", \"versions\": [{\"status\": \"unaffected\", \"version\": \"openshift-rhel9\", \"lessThan\": \"*\", \"versionType\": \"rpm\"}], \"packageName\": \"rhbk-openshift-rhel9/rhbk\", \"collectionURL\": \"https://access.redhat.com/downloads/content/package-browser/\", \"defaultStatus\": \"affected\"}, {\"cpes\": [\"cpe:/a:redhat:build_keycloak:26.6::el9\"], \"vendor\": \"Red Hat\", \"product\": \"Red Hat build of Keycloak 26.6.5\", \"versions\": [{\"status\": \"unaffected\", \"version\": \"rhel9-operator\", \"lessThan\": \"*\", \"versionType\": \"rpm\"}], \"packageName\": \"rhbk-rhel9-operator/rhbk\", \"collectionURL\": \"https://access.redhat.com/downloads/content/package-browser/\", \"defaultStatus\": \"affected\"}, {\"cpes\": [\"cpe:/a:redhat:jboss_data_grid:8\"], \"vendor\": \"Red Hat\", \"product\": \"Red Hat Data Grid 8.6.2\", \"packageName\": \"micrometer-core\", \"collectionURL\": \"https://access.redhat.com/downloads/content/package-browser/\", \"defaultStatus\": \"unaffected\"}, {\"cpes\": [\"cpe:/a:redhat:amq_broker:7\"], \"vendor\": \"Red Hat\", \"product\": \"Red Hat AMQ Broker 7\", \"packageName\": \"micrometer-core\", \"collectionURL\": \"https://access.redhat.com/downloads/content/package-browser/\", \"defaultStatus\": \"affected\"}, {\"cpes\": [\"cpe:/a:redhat:amq_clients:2023\"], \"vendor\": \"Red Hat\", \"product\": \"Red Hat AMQ Clients\", \"packageName\": \"micrometer-core\", \"collectionURL\": \"https://access.redhat.com/downloads/content/package-browser/\", \"defaultStatus\": \"affected\"}, {\"cpes\": [\"cpe:/a:redhat:camel_quarkus:3\"], \"vendor\": \"Red Hat\", \"product\": \"Red Hat build of Apache Camel 4 for Quarkus 3\", \"packageName\": \"micrometer-core\", \"collectionURL\": \"https://access.redhat.com/downloads/content/package-browser/\", \"defaultStatus\": \"affected\"}, {\"cpes\": [\"cpe:/a:redhat:apache_camel_hawtio:4\"], \"vendor\": \"Red Hat\", \"product\": \"Red Hat build of Apache Camel - HawtIO 4\", \"packageName\": \"micrometer-core\", \"collectionURL\": \"https://access.redhat.com/downloads/content/package-browser/\", \"defaultStatus\": \"affected\"}, {\"cpes\": [\"cpe:/a:redhat:apicurio_registry:3\"], \"vendor\": \"Red Hat\", \"product\": \"Red Hat build of Apicurio Registry 3\", \"packageName\": \"micrometer-core\", \"collectionURL\": \"https://access.redhat.com/downloads/content/package-browser/\", \"defaultStatus\": \"affected\"}, {\"cpes\": [\"cpe:/a:redhat:debezium:3\"], \"vendor\": \"Red Hat\", \"product\": \"Red Hat build of Debezium 3\", \"packageName\": \"micrometer-core\", \"collectionURL\": \"https://access.redhat.com/downloads/content/package-browser/\", \"defaultStatus\": \"affected\"}, {\"cpes\": [\"cpe:/a:redhat:optaplanner:::el6\"], \"vendor\": \"Red Hat\", \"product\": \"Red Hat build of OptaPlanner 8\", \"packageName\": \"micrometer-core\", \"collectionURL\": \"https://access.redhat.com/downloads/content/package-browser/\", \"defaultStatus\": \"affected\"}, {\"cpes\": [\"cpe:/a:redhat:quarkus:3\"], \"vendor\": \"Red Hat\", \"product\": \"Red Hat build of Quarkus\", \"packageName\": \"micrometer-core\", \"collectionURL\": \"https://access.redhat.com/downloads/content/package-browser/\", \"defaultStatus\": \"affected\"}, {\"cpes\": [\"cpe:/a:redhat:jboss_fuse:7\"], \"vendor\": \"Red Hat\", \"product\": \"Red Hat Fuse 7\", \"packageName\": \"micrometer-core\", \"collectionURL\": \"https://access.redhat.com/downloads/content/package-browser/\", \"defaultStatus\": \"unknown\"}, {\"cpes\": [\"cpe:/a:redhat:jbosseapxp\"], \"vendor\": \"Red Hat\", \"product\": \"Red Hat JBoss Enterprise Application Platform Expansion Pack\", \"packageName\": \"micrometer-core\", \"collectionURL\": \"https://access.redhat.com/downloads/content/package-browser/\", \"defaultStatus\": \"affected\"}, {\"cpes\": [\"cpe:/a:redhat:openshift_ai\"], \"vendor\": \"Red Hat\", \"product\": \"Red Hat OpenShift AI (RHOAI)\", \"packageName\": \"rhoai/odh-trustyai-service-rhel9\", \"collectionURL\": \"https://access.redhat.com/downloads/content/package-browser/\", \"defaultStatus\": \"unaffected\"}, {\"cpes\": [\"cpe:/a:redhat:openshift_devspaces:3\"], \"vendor\": \"Red Hat\", \"product\": \"Red Hat OpenShift Dev Spaces\", \"packageName\": \"devspaces/openvsx-rhel9\", \"collectionURL\": \"https://access.redhat.com/downloads/content/package-browser/\", \"defaultStatus\": \"affected\"}, {\"cpes\": [\"cpe:/a:redhat:openshift_devspaces:3\"], \"vendor\": \"Red Hat\", \"product\": \"Red Hat OpenShift Dev Spaces\", \"packageName\": \"devspaces/pluginregistry-rhel9\", \"collectionURL\": \"https://access.redhat.com/downloads/content/package-browser/\", \"defaultStatus\": \"affected\"}, {\"cpes\": [\"cpe:/a:redhat:openshift_devspaces:3\"], \"vendor\": \"Red Hat\", \"product\": \"Red Hat OpenShift Dev Spaces\", \"packageName\": \"devspaces/server-rhel9\", \"collectionURL\": \"https://access.redhat.com/downloads/content/package-browser/\", \"defaultStatus\": \"unknown\"}, {\"cpes\": [\"cpe:/a:redhat:jboss_enterprise_bpms_platform:7\"], \"vendor\": \"Red Hat\", \"product\": \"Red Hat Process Automation 7\", \"packageName\": \"micrometer-core\", \"collectionURL\": \"https://access.redhat.com/downloads/content/package-browser/\", \"defaultStatus\": \"affected\"}, {\"cpes\": [\"cpe:/a:redhat:amq_streams:2\"], \"vendor\": \"Red Hat\", \"product\": \"streams for Apache Kafka 2\", \"packageName\": \"micrometer-core\", \"collectionURL\": \"https://access.redhat.com/downloads/content/package-browser/\", \"defaultStatus\": \"affected\"}, {\"cpes\": [\"cpe:/a:redhat:amq_streams:3\"], \"vendor\": \"Red Hat\", \"product\": \"streams for Apache Kafka 3\", \"packageName\": \"micrometer-core\", \"collectionURL\": \"https://access.redhat.com/downloads/content/package-browser/\", \"defaultStatus\": \"affected\"}], \"timeline\": [{\"lang\": \"en\", \"time\": \"2026-06-09T05:01:51.700Z\", \"value\": \"Reported to Red Hat.\"}, {\"lang\": \"en\", \"time\": \"2026-06-09T03:47:46.447Z\", \"value\": \"Made public.\"}], \"solutions\": [{\"lang\": \"en\", \"value\": \"RHSA-2026:50849: Red Hat build of Keycloak 26.6\"}, {\"lang\": \"en\", \"value\": \"RHSA-2026:36839: Red Hat Build of Apache Camel 4.18 for Quarkus 3.33\"}, {\"lang\": \"en\", \"value\": \"RHSA-2026:41951: Red Hat Data Grid 8.6.2\"}, {\"lang\": \"en\", \"value\": \"RHSA-2026:37390: Red Hat build of Apache Camel 4.18.1.P1 for Spring Boot 3.5.16\"}, {\"lang\": \"en\", \"value\": \"RHSA-2026:50848: Red Hat build of Keycloak 26.6.5\"}, {\"lang\": \"en\", \"value\": \"RHSA-2026:54435: Streams for Apache Kafka 3.2.1\"}], \"x_adpType\": \"supplier\", \"datePublic\": \"2026-06-09T03:47:46.447Z\", \"references\": [{\"url\": \"https://access.redhat.com/security/cve/CVE-2026-40984\", \"tags\": [\"vdb-entry\", \"x_refsource_REDHAT\"]}, {\"url\": \"https://bugzilla.redhat.com/show_bug.cgi?id=2486716\", \"name\": \"RHBZ#2486716\", \"tags\": [\"issue-tracking\", \"x_refsource_REDHAT\"]}, {\"url\": \"https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-40984.json\", \"tags\": [\"x_sadp-csaf-vex\"]}, {\"url\": \"https://access.redhat.com/errata/RHSA-2026:50849\", \"tags\": [\"vendor-advisory\", \"x_refsource_REDHAT\"]}, {\"url\": \"https://access.redhat.com/errata/RHSA-2026:36839\", \"tags\": [\"vendor-advisory\", \"x_refsource_REDHAT\"]}, {\"url\": \"https://access.redhat.com/errata/RHSA-2026:41951\", \"tags\": [\"vendor-advisory\", \"x_refsource_REDHAT\"]}, {\"url\": \"https://access.redhat.com/errata/RHSA-2026:37390\", \"tags\": [\"vendor-advisory\", \"x_refsource_REDHAT\"]}, {\"url\": \"https://access.redhat.com/errata/RHSA-2026:50848\", \"tags\": [\"vendor-advisory\", \"x_refsource_REDHAT\"]}, {\"url\": \"https://access.redhat.com/errata/RHSA-2026:54435\", \"tags\": [\"vendor-advisory\", \"x_refsource_REDHAT\"]}], \"x_generator\": {\"engine\": \"sadp-cli 1.0.0\"}, \"descriptions\": [{\"lang\": \"en\", \"value\": \"A flaw was found in Micrometer. A remote attacker can provide specially crafted HTTP requests, which may lead to a denial-of-service (DoS) condition. This vulnerability allows an attacker to disrupt the availability of the affected system.\"}], \"problemTypes\": [{\"descriptions\": [{\"lang\": \"en\", \"type\": \"CWE\", \"cweId\": \"CWE-770\", \"description\": \"Allocation of Resources Without Limits or Throttling\"}]}], \"providerMetadata\": {\"orgId\": \"0b0ca135-0b70-47e7-9f44-1890c2a1c46c\", \"shortName\": \"redhat-SADP\", \"dateUpdated\": \"2026-08-13T12:04:30.875Z\"}}, {\"title\": \"CISA ADP Vulnrichment\", \"metrics\": [{\"other\": {\"type\": \"ssvc\", \"content\": {\"id\": \"CVE-2026-40984\", \"role\": \"CISA Coordinator\", \"options\": [{\"Exploitation\": \"none\"}, {\"Automatable\": \"yes\"}, {\"Technical Impact\": \"partial\"}], \"version\": \"2.0.3\", \"timestamp\": \"2026-06-09T13:49:55.899071Z\"}}}], \"providerMetadata\": {\"orgId\": \"134c704f-9b21-4f2e-91b3-4a467353bcc0\", \"shortName\": \"CISA-ADP\", \"dateUpdated\": \"2026-06-09T13:49:59.796Z\"}}], \"cna\": {\"title\": \"Micrometer HTTP server instrumentations DoS vulnerability\", \"source\": {\"discovery\": \"UNKNOWN\"}, \"impacts\": [{\"descriptions\": [{\"lang\": \"en\", \"value\": \"An unauthenticated remote attacker can cause denial of service by sending specially crafted HTTP requests that trigger excessive resource consumption in applications using Micrometer HTTP server instrumentations.\"}]}], \"metrics\": [{\"format\": \"CVSS\", \"cvssV3_1\": {\"scope\": \"UNCHANGED\", \"version\": \"3.1\", \"baseScore\": 7.5, \"attackVector\": \"NETWORK\", \"baseSeverity\": \"HIGH\", \"vectorString\": \"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H\", \"integrityImpact\": \"NONE\", \"userInteraction\": \"NONE\", \"attackComplexity\": \"LOW\", \"availabilityImpact\": \"HIGH\", \"privilegesRequired\": \"NONE\", \"confidentialityImpact\": \"NONE\"}, \"scenarios\": [{\"lang\": \"en\", \"value\": \"GENERAL\"}]}], \"affected\": [{\"vendor\": \"Spring\", \"product\": \"Micrometer\", \"versions\": [{\"status\": \"affected\", \"version\": \"1.16.0\", \"lessThan\": \"1.16.5.1\", \"versionType\": \"custom\"}, {\"status\": \"affected\", \"version\": \"1.15.0\", \"lessThan\": \"1.15.11.1\", \"versionType\": \"custom\"}, {\"status\": \"affected\", \"version\": \"1.14.0\", \"lessThan\": \"1.14.16\", \"versionType\": \"custom\"}, {\"status\": \"affected\", \"version\": \"1.13.0\", \"lessThan\": \"1.13.19\", \"versionType\": \"custom\"}, {\"status\": \"affected\", \"version\": \"1.9.0\", \"lessThan\": \"1.9.18\", \"versionType\": \"custom\"}], \"packageName\": \"micrometer-core\", \"defaultStatus\": \"unaffected\"}, {\"vendor\": \"Spring\", \"product\": \"Micrometer\", \"versions\": [{\"status\": \"affected\", \"version\": \"1.16.0\", \"lessThan\": \"1.16.5.1\", \"versionType\": \"custom\"}, {\"status\": \"affected\", \"version\": \"1.15.0\", \"lessThan\": \"1.15.11.1\", \"versionType\": \"custom\"}, {\"status\": \"affected\", \"version\": \"1.14.0\", \"lessThan\": \"1.14.16\", \"versionType\": \"custom\"}, {\"status\": \"affected\", \"version\": \"1.13.0\", \"lessThan\": \"1.13.19\", \"versionType\": \"custom\"}], \"packageName\": \"micrometer-jetty11\", \"defaultStatus\": \"unaffected\"}, {\"vendor\": \"Spring\", \"product\": \"Micrometer\", \"versions\": [{\"status\": \"affected\", \"version\": \"1.16.0\", \"lessThan\": \"1.16.6\", \"versionType\": \"custom\"}, {\"status\": \"affected\", \"version\": \"1.15.0\", \"lessThan\": \"1.15.11.\", \"versionType\": \"custom\"}, {\"status\": \"affected\", \"version\": \"1.14.0\", \"lessThan\": \"1.14.15.1\", \"versionType\": \"custom\"}, {\"status\": \"affected\", \"version\": \"1.13.0\", \"lessThan\": \"1.13.19\", \"versionType\": \"custom\"}], \"packageName\": \"micrometer-jetty12\", \"defaultStatus\": \"unaffected\"}], \"references\": [{\"url\": \"https://spring.io/security/cve-2026-40984\"}], \"x_generator\": {\"engine\": \"Vulnogram 1.0.1\"}, \"descriptions\": [{\"lang\": \"en\", \"value\": \"In Micrometer, it is possible for a user to provide specially crafted HTTP requests that may cause a denial-of-service (DoS) condition.\\n\\nAffected versions:\\nmicrometer-core 1.16.0 through 1.16.5; 1.15.0 through 1.15.11; 1.14.0 through 1.14.15; 1.13.0 through 1.13.18; 1.9.0 through 1.9.17.\\nmicrometer-jetty11 1.16.0 through 1.16.5; 1.15.0 through 1.15.11; 1.14.0 through 1.14.15; 1.13.0 through 1.13.18.\\nmicrometer-jetty12 1.16.0 through 1.16.5; 1.15.0 through 1.15.11; 1.14.0 through 1.14.15; 1.13.0 through 1.13.18.\", \"supportingMedia\": [{\"type\": \"text/html\", \"value\": \"In Micrometer, it is possible for a user to provide specially crafted HTTP requests that may cause a denial-of-service (DoS) condition.\\n\\nAffected versions:\\nmicrometer-core 1.16.0 through 1.16.5; 1.15.0 through 1.15.11; 1.14.0 through 1.14.15; 1.13.0 through 1.13.18; 1.9.0 through 1.9.17.\\nmicrometer-jetty11 1.16.0 through 1.16.5; 1.15.0 through 1.15.11; 1.14.0 through 1.14.15; 1.13.0 through 1.13.18.\\nmicrometer-jetty12 1.16.0 through 1.16.5; 1.15.0 through 1.15.11; 1.14.0 through 1.14.15; 1.13.0 through 1.13.18.\", \"base64\": false}]}], \"problemTypes\": [{\"descriptions\": [{\"lang\": \"en\", \"type\": \"CWE\", \"cweId\": \"CWE-400\", \"description\": \"CWE-400: Uncontrolled Resource Consumption\"}]}], \"providerMetadata\": {\"orgId\": \"dcf2e128-44bd-42ed-91e8-88f912c1401d\", \"shortName\": \"vmware\", \"dateUpdated\": \"2026-06-23T20:06:22.279Z\"}}}",
      "cveMetadata": "{\"cveId\": \"CVE-2026-40984\", \"state\": \"PUBLISHED\", \"dateUpdated\": \"2026-08-13T12:04:30.875Z\", \"dateReserved\": \"2026-04-16T02:19:09.388Z\", \"assignerOrgId\": \"dcf2e128-44bd-42ed-91e8-88f912c1401d\", \"datePublished\": \"2026-06-09T03:47:46.447Z\", \"assignerShortName\": \"vmware\"}",
      "dataType": "CVE_RECORD",
      "dataVersion": "5.2"
    }
  }
}

CERTFR-2026-AVI-0702

Vulnerability from certfr_avis - Published: 2026-06-08 - Updated: 2026-06-08

De multiples vulnérabilités ont été découvertes dans Spring Micrometer. Elles permettent à un attaquant de provoquer un déni de service à distance.

Solutions

Se référer au bulletin de sécurité de l'éditeur pour l'obtention des correctifs (cf. section Documentation).

Impacted products

Vendor	Product	Description
Spring	Micrometer	Micrometer Core, Jetty11 et Jetty12 versions 1.9.x antérieures à 1.9.18
Spring	Micrometer	Micrometer versions 1.16.x antérieures à 1.16.6
Spring	Micrometer	Micrometer Jetty11 et Jetty12 versions 1.13.x antérieures à 1.13.19
Spring	Micrometer	Micrometer versions 1.15.x antérieures à 1.15.12
Spring	Micrometer	Micrometer Jetty11 et Jetty12 versions 1.14.x antérieures à 1.14.16

References

Title

Publication Time

cleanstart-2026-ba48144

Vulnerability from cleanstart

Published

2026-07-30 07:10

Modified

2026-07-30 09:39

Summary

Security fixes in keycloak 26.5.7-r5

Details

Package keycloak version 26.5.7-r5 fixes 11 vulnerabilities: CVE-2026-54291, CVE-2026-54512, CVE-2026-54513, CVE-2026-54514, CVE-2026-54515...

References

URL

Type

https://github.com/keycloak/keycloak

WEB

JSON

To clipboard

{
  "affected": [
    {
      "package": {
        "ecosystem": "Alpine",
        "name": "keycloak"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "0"
            },
            {
              "fixed": "26.5.7-r5"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ],
      "versions": [
        "26.5.7-r5"
      ]
    }
  ],
  "credits": [],
  "database_specific": {},
  "details": "Package keycloak version 26.5.7-r5 fixes 11 vulnerabilities: CVE-2026-54291, CVE-2026-54512, CVE-2026-54513, CVE-2026-54514, CVE-2026-54515...",
  "id": "CLEANSTART-2026-BA48144",
  "modified": "2026-07-30T09:39:28Z",
  "published": "2026-07-30T07:10:53Z",
  "references": [
    {
      "type": "WEB",
      "url": "https://github.com/keycloak/keycloak"
    }
  ],
  "related": [],
  "schema_version": "1.7.3",
  "summary": "Security fixes in keycloak 26.5.7-r5",
  "upstream": [
    "CVE-2026-54291",
    "CVE-2026-54512",
    "CVE-2026-54513",
    "CVE-2026-54514",
    "CVE-2026-54515",
    "CVE-2026-54516",
    "CVE-2026-54517",
    "CVE-2026-40984",
    "CVE-2025-66560",
    "CVE-2026-50559",
    "CVE-2025-11537"
  ]
}

cleanstart-2026-bq50387

Vulnerability from cleanstart

Published

2026-07-30 07:10

Modified

2026-07-30 09:35

Summary

Security fixes in apache-nifi 2.6.0-r3

Details

Package apache-nifi version 2.6.0-r3 fixes 51 vulnerabilities: CVE-2024-29371, CVE-2024-45993, CVE-2025-8671, CVE-2025-11143, CVE-2025-31344...

References

URL

Type

https://github.com/apache/nifi

WEB

JSON

To clipboard

{
  "affected": [
    {
      "package": {
        "ecosystem": "Alpine",
        "name": "apache-nifi"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "0"
            },
            {
              "fixed": "2.6.0-r3"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ],
      "versions": [
        "2.6.0-r3"
      ]
    }
  ],
  "credits": [],
  "database_specific": {},
  "details": "Package apache-nifi version 2.6.0-r3 fixes 51 vulnerabilities: CVE-2024-29371, CVE-2024-45993, CVE-2025-8671, CVE-2025-11143, CVE-2025-31344...",
  "id": "CLEANSTART-2026-BQ50387",
  "modified": "2026-07-30T09:35:44Z",
  "published": "2026-07-30T07:10:53Z",
  "references": [
    {
      "type": "WEB",
      "url": "https://github.com/apache/nifi"
    }
  ],
  "related": [],
  "schema_version": "1.7.3",
  "summary": "Security fixes in apache-nifi 2.6.0-r3",
  "upstream": [
    "CVE-2024-29371",
    "CVE-2024-45993",
    "CVE-2025-8671",
    "CVE-2025-11143",
    "CVE-2025-31344",
    "CVE-2025-48924",
    "CVE-2025-66524",
    "CVE-2026-1605",
    "CVE-2026-2332",
    "CVE-2026-9828",
    "CVE-2026-13006",
    "CVE-2026-14683",
    "CVE-2026-14684",
    "CVE-2026-22735",
    "CVE-2026-22740",
    "CVE-2026-22745",
    "CVE-2026-23868",
    "CVE-2026-25903",
    "CVE-2026-26740",
    "CVE-2026-33117",
    "CVE-2026-40984",
    "CVE-2026-40988",
    "CVE-2026-41003",
    "CVE-2026-41694",
    "CVE-2026-41695",
    "CVE-2026-41706",
    "CVE-2026-41711",
    "CVE-2026-41715",
    "CVE-2026-41716",
    "CVE-2026-41719",
    "CVE-2026-41721",
    "CVE-2026-41839",
    "CVE-2026-41840",
    "CVE-2026-41845",
    "CVE-2026-41848",
    "CVE-2026-41850",
    "CVE-2026-41851",
    "CVE-2026-41852",
    "CVE-2026-41853",
    "CVE-2026-41854",
    "CVE-2026-41855",
    "CVE-2026-46718",
    "CVE-2026-47065",
    "CVE-2026-47838",
    "CVE-2026-54399",
    "CVE-2026-54428",
    "CVE-2026-54512",
    "CVE-2026-54513",
    "CVE-2026-54514",
    "CVE-2026-54515",
    "ghsa-72hv-8253-57qq"
  ]
}

cleanstart-2026-od16779

Vulnerability from cleanstart

Published

2026-07-30 07:10

Modified

2026-07-30 09:35

Summary

Security fixes in apache-nifi 2.9.0-r3

Details

Package apache-nifi version 2.9.0-r3 fixes 55 vulnerabilities: CVE-2024-45993, CVE-2025-31344, CVE-2025-67721, CVE-2025-8671, CVE-2026-10532...

References

URL

Type

https://github.com/apache/nifi

WEB

JSON

To clipboard

{
  "affected": [
    {
      "package": {
        "ecosystem": "Alpine",
        "name": "apache-nifi"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "0"
            },
            {
              "fixed": "2.9.0-r3"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ],
      "versions": [
        "2.9.0-r3"
      ]
    }
  ],
  "credits": [],
  "database_specific": {},
  "details": "Package apache-nifi version 2.9.0-r3 fixes 55 vulnerabilities: CVE-2024-45993, CVE-2025-31344, CVE-2025-67721, CVE-2025-8671, CVE-2026-10532...",
  "id": "CLEANSTART-2026-OD16779",
  "modified": "2026-07-30T09:35:43Z",
  "published": "2026-07-30T07:10:53Z",
  "references": [
    {
      "type": "WEB",
      "url": "https://github.com/apache/nifi"
    }
  ],
  "related": [],
  "schema_version": "1.7.3",
  "summary": "Security fixes in apache-nifi 2.9.0-r3",
  "upstream": [
    "CVE-2024-45993",
    "CVE-2025-31344",
    "CVE-2025-67721",
    "CVE-2025-8671",
    "CVE-2026-10532",
    "CVE-2026-13006",
    "CVE-2026-14683",
    "CVE-2026-14684",
    "CVE-2026-22740",
    "CVE-2026-22745",
    "CVE-2026-23868",
    "CVE-2026-26740",
    "CVE-2026-40542",
    "CVE-2026-40983",
    "CVE-2026-40984",
    "CVE-2026-40988",
    "CVE-2026-41003",
    "CVE-2026-41694",
    "CVE-2026-41695",
    "CVE-2026-41706",
    "CVE-2026-41711",
    "CVE-2026-41715",
    "CVE-2026-41716",
    "CVE-2026-41719",
    "CVE-2026-41721",
    "CVE-2026-41839",
    "CVE-2026-41840",
    "CVE-2026-41845",
    "CVE-2026-41848",
    "CVE-2026-41850",
    "CVE-2026-41851",
    "CVE-2026-41852",
    "CVE-2026-41853",
    "CVE-2026-41854",
    "CVE-2026-41855",
    "CVE-2026-44911",
    "CVE-2026-44913",
    "CVE-2026-44914",
    "CVE-2026-46718",
    "CVE-2026-47065",
    "CVE-2026-47838",
    "CVE-2026-49099",
    "CVE-2026-54399",
    "CVE-2026-54428",
    "CVE-2026-54512",
    "CVE-2026-54513",
    "CVE-2026-54514",
    "CVE-2026-54515",
    "CVE-2026-54516",
    "CVE-2026-54517",
    "CVE-2026-54518",
    "CVE-2026-54665",
    "CVE-2026-9563",
    "CVE-2026-9828",
    "ghsa-72hv-8253-57qq"
  ]
}

cleanstart-2026-ov94117

Vulnerability from cleanstart

Published

2026-07-30 07:10

Modified

2026-07-30 09:33

Summary

Security fixes in rundeck 6.0.0-r0

Details

Package rundeck version 6.0.0-r0 fixes 52 vulnerabilities: CVE-2026-42505, CVE-2026-39822, CVE-2025-67030, CVE-2026-55153, CVE-2026-34986...

References

URL

Type

https://github.com/rundeck/rundeck

WEB

JSON

To clipboard

{
  "affected": [
    {
      "package": {
        "ecosystem": "Alpine",
        "name": "rundeck"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "0"
            },
            {
              "fixed": "6.0.0-r0"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ],
      "versions": [
        "6.0.0-r0"
      ]
    }
  ],
  "credits": [],
  "database_specific": {},
  "details": "Package rundeck version 6.0.0-r0 fixes 52 vulnerabilities: CVE-2026-42505, CVE-2026-39822, CVE-2025-67030, CVE-2026-55153, CVE-2026-34986...",
  "id": "CLEANSTART-2026-OV94117",
  "modified": "2026-07-30T09:33:17Z",
  "published": "2026-07-30T07:10:53Z",
  "references": [
    {
      "type": "WEB",
      "url": "https://github.com/rundeck/rundeck"
    }
  ],
  "related": [],
  "schema_version": "1.7.3",
  "summary": "Security fixes in rundeck 6.0.0-r0",
  "upstream": [
    "CVE-2026-42505",
    "CVE-2026-39822",
    "CVE-2025-67030",
    "CVE-2026-55153",
    "CVE-2026-34986",
    "CVE-2026-39827",
    "CVE-2026-39828",
    "CVE-2026-39829",
    "CVE-2026-39830",
    "CVE-2026-39831",
    "CVE-2026-39832",
    "CVE-2026-39833",
    "CVE-2026-39834",
    "CVE-2026-39835",
    "CVE-2026-42508",
    "CVE-2026-46595",
    "CVE-2026-46597",
    "CVE-2026-46598",
    "CVE-2026-25680",
    "CVE-2026-25681",
    "CVE-2026-27136",
    "CVE-2026-33814",
    "CVE-2026-39821",
    "CVE-2026-42502",
    "CVE-2026-42506",
    "CVE-2026-39824",
    "CVE-2024-10005",
    "CVE-2024-10006",
    "CVE-2026-22751",
    "CVE-2026-22746",
    "CVE-2026-47838",
    "CVE-2026-41706",
    "CVE-2026-41001",
    "CVE-2026-40992",
    "CVE-2026-41842",
    "CVE-2026-41841",
    "CVE-2026-41844",
    "CVE-2026-41846",
    "CVE-2026-41843",
    "CVE-2026-41851",
    "CVE-2026-41848",
    "CVE-2026-41854",
    "CVE-2026-41853",
    "CVE-2026-41840",
    "CVE-2026-41845",
    "CVE-2026-41839",
    "CVE-2026-41852",
    "CVE-2026-41850",
    "CVE-2026-40984",
    "CVE-2026-40983",
    "CVE-2026-54291",
    "CVE-2026-5795"
  ]
}

cleanstart-2026-to43731

Vulnerability from cleanstart

Published

2026-07-30 07:10

Modified

2026-07-30 09:39

Summary

Security fixes in keycloak 26.4.7-r7

Details

Package keycloak version 26.4.7-r7 fixes 2 vulnerabilities: CVE-2026-40984, CVE-2026-50559

References

URL

Type

https://github.com/keycloak/keycloak

WEB

JSON

To clipboard

{
  "affected": [
    {
      "package": {
        "ecosystem": "Alpine",
        "name": "keycloak"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "0"
            },
            {
              "fixed": "26.4.7-r7"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ],
      "versions": [
        "26.4.7-r7"
      ]
    }
  ],
  "credits": [],
  "database_specific": {},
  "details": "Package keycloak version 26.4.7-r7 fixes 2 vulnerabilities: CVE-2026-40984, CVE-2026-50559",
  "id": "CLEANSTART-2026-TO43731",
  "modified": "2026-07-30T09:39:33Z",
  "published": "2026-07-30T07:10:53Z",
  "references": [
    {
      "type": "WEB",
      "url": "https://github.com/keycloak/keycloak"
    }
  ],
  "related": [],
  "schema_version": "1.7.3",
  "summary": "Security fixes in keycloak 26.4.7-r7",
  "upstream": [
    "CVE-2026-40984",
    "CVE-2026-50559"
  ]
}

cleanstart-2026-wt54034

Vulnerability from cleanstart

Published

2026-07-21 07:50

Modified

2026-07-15 06:27

Summary

Security fixes for CVE-2025-8671, CVE-2026-0636, CVE-2026-10532, CVE-2026-13006, CVE-2026-1605, CVE-2026-22732, CVE-2026-2332, CVE-2026-24281, CVE-2026-33870, CVE-2026-33871, CVE-2026-3505, CVE-2026-40983, CVE-2026-40984, CVE-2026-54399, CVE-2026-54428, CVE-2026-54512, CVE-2026-54513, CVE-2026-54514, CVE-2026-54515, CVE-2026-54516, CVE-2026-54517, CVE-2026-54518, CVE-2026-5588, CVE-2026-9828, ghsa-355h-qmc2-wpwf, ghsa-3677-xxcr-wjqv, ghsa-38f8-5428-x5cv, ghsa-3qp7-7mw8-wx86, ghsa-45q3-82m4-75jr, ghsa-563q-j3cm-6jxm, ghsa-57rv-r2g8-2cj3, ghsa-5pvg-856g-cp85, ghsa-5x3r-wrvg-rp6q, ghsa-676x-f7gg-47vc, ghsa-72hv-8253-57qq, ghsa-c2gf-v879-257j, ghsa-c3fc-8qff-9hwx, ghsa-c653-97m9-rcg9, ghsa-cj8j-37rh-8475, ghsa-cm33-6792-r9fm, ghsa-cmm3-54f8-px4j, ghsa-cq4q-cv5g-r8q5, ghsa-cvc6-q2cp-2xhw, ghsa-f6hv-jmp6-3vwv, ghsa-hvcg-qmg6-jm4c, ghsa-m4cv-j2px-7723, ghsa-mj4r-2hfc-f8p6, ghsa-qqpg-mvqg-649v, ghsa-rwm7-x88c-3g2p, ghsa-v8h7-rr48-vmmv, ghsa-vxf7-qj7q-83fh, ghsa-w573-9ffj-6ff9, ghsa-wg6q-6289-32hp, ghsa-x2wq-9x2f-fhj7, ghsa-x44p-gvrj-pj2r, ghsa-x4gw-5cx5-pgmh, ghsa-xmv7-r254-6q78, ghsa-xxqh-mfjm-7mv9 applied in versions: 2.10.0-r1, 2.10.0-r2, 2.7.2-r0, 2.7.2-r2, 2.9.0-r0, 2.9.0-r1

Details

Multiple security vulnerabilities affect the apache-nifi package. These issues are resolved in later releases. See references for individual vulnerability details.

References

URL

Type

	https://github.com/cleanstart-dev/cleanstart-secu…	ADVISORY
	https://osv.dev/vulnerability/CVE-2025-8671	WEB
	https://osv.dev/vulnerability/CVE-2026-0636	WEB
	https://osv.dev/vulnerability/CVE-2026-10532	WEB
	https://osv.dev/vulnerability/CVE-2026-13006	WEB
	https://osv.dev/vulnerability/CVE-2026-1605	WEB
	https://osv.dev/vulnerability/CVE-2026-22732	WEB
	https://osv.dev/vulnerability/CVE-2026-2332	WEB
	https://osv.dev/vulnerability/CVE-2026-24281	WEB
	https://osv.dev/vulnerability/CVE-2026-33870	WEB
	https://osv.dev/vulnerability/CVE-2026-33871	WEB
	https://osv.dev/vulnerability/CVE-2026-3505	WEB
	https://osv.dev/vulnerability/CVE-2026-40983	WEB
	https://osv.dev/vulnerability/CVE-2026-40984	WEB
	https://osv.dev/vulnerability/CVE-2026-54399	WEB
	https://osv.dev/vulnerability/CVE-2026-54428	WEB
	https://osv.dev/vulnerability/CVE-2026-54512	WEB
	https://osv.dev/vulnerability/CVE-2026-54513	WEB
	https://osv.dev/vulnerability/CVE-2026-54514	WEB
	https://osv.dev/vulnerability/CVE-2026-54515	WEB
	https://osv.dev/vulnerability/CVE-2026-54516	WEB
	https://osv.dev/vulnerability/CVE-2026-54517	WEB
	https://osv.dev/vulnerability/CVE-2026-54518	WEB
	https://osv.dev/vulnerability/CVE-2026-5588	WEB
	https://osv.dev/vulnerability/CVE-2026-9828	WEB
	https://osv.dev/vulnerability/ghsa-355h-qmc2-wpwf	WEB
	https://osv.dev/vulnerability/ghsa-3677-xxcr-wjqv	WEB
	https://osv.dev/vulnerability/ghsa-38f8-5428-x5cv	WEB
	https://osv.dev/vulnerability/ghsa-3qp7-7mw8-wx86	WEB
	https://osv.dev/vulnerability/ghsa-45q3-82m4-75jr	WEB
	https://osv.dev/vulnerability/ghsa-563q-j3cm-6jxm	WEB
	https://osv.dev/vulnerability/ghsa-57rv-r2g8-2cj3	WEB
	https://osv.dev/vulnerability/ghsa-5pvg-856g-cp85	WEB
	https://osv.dev/vulnerability/ghsa-5x3r-wrvg-rp6q	WEB
	https://osv.dev/vulnerability/ghsa-676x-f7gg-47vc	WEB
	https://osv.dev/vulnerability/ghsa-72hv-8253-57qq	WEB
	https://osv.dev/vulnerability/ghsa-c2gf-v879-257j	WEB
	https://osv.dev/vulnerability/ghsa-c3fc-8qff-9hwx	WEB
	https://osv.dev/vulnerability/ghsa-c653-97m9-rcg9	WEB
	https://osv.dev/vulnerability/ghsa-cj8j-37rh-8475	WEB
	https://osv.dev/vulnerability/ghsa-cm33-6792-r9fm	WEB
	https://osv.dev/vulnerability/ghsa-cmm3-54f8-px4j	WEB
	https://osv.dev/vulnerability/ghsa-cq4q-cv5g-r8q5	WEB
	https://osv.dev/vulnerability/ghsa-cvc6-q2cp-2xhw	WEB
	https://osv.dev/vulnerability/ghsa-f6hv-jmp6-3vwv	WEB
	https://osv.dev/vulnerability/ghsa-hvcg-qmg6-jm4c	WEB
	https://osv.dev/vulnerability/ghsa-m4cv-j2px-7723	WEB
	https://osv.dev/vulnerability/ghsa-mj4r-2hfc-f8p6	WEB
	https://osv.dev/vulnerability/ghsa-qqpg-mvqg-649v	WEB
	https://osv.dev/vulnerability/ghsa-rwm7-x88c-3g2p	WEB
	https://osv.dev/vulnerability/ghsa-v8h7-rr48-vmmv	WEB
	https://osv.dev/vulnerability/ghsa-vxf7-qj7q-83fh	WEB
	https://osv.dev/vulnerability/ghsa-w573-9ffj-6ff9	WEB
	https://osv.dev/vulnerability/ghsa-wg6q-6289-32hp	WEB
	https://osv.dev/vulnerability/ghsa-x2wq-9x2f-fhj7	WEB
	https://osv.dev/vulnerability/ghsa-x44p-gvrj-pj2r	WEB
	https://osv.dev/vulnerability/ghsa-x4gw-5cx5-pgmh	WEB
	https://osv.dev/vulnerability/ghsa-xmv7-r254-6q78	WEB
	https://osv.dev/vulnerability/ghsa-xxqh-mfjm-7mv9	WEB
	https://nvd.nist.gov/vuln/detail/CVE-2025-8671	WEB
	https://nvd.nist.gov/vuln/detail/CVE-2026-0636	WEB
	https://nvd.nist.gov/vuln/detail/CVE-2026-10532	WEB
	https://nvd.nist.gov/vuln/detail/CVE-2026-13006	WEB
	https://nvd.nist.gov/vuln/detail/CVE-2026-1605	WEB
	https://nvd.nist.gov/vuln/detail/CVE-2026-22732	WEB
	https://nvd.nist.gov/vuln/detail/CVE-2026-2332	WEB
	https://nvd.nist.gov/vuln/detail/CVE-2026-24281	WEB
	https://nvd.nist.gov/vuln/detail/CVE-2026-33870	WEB
	https://nvd.nist.gov/vuln/detail/CVE-2026-33871	WEB
	https://nvd.nist.gov/vuln/detail/CVE-2026-3505	WEB
	https://nvd.nist.gov/vuln/detail/CVE-2026-40983	WEB
	https://nvd.nist.gov/vuln/detail/CVE-2026-40984	WEB
	https://nvd.nist.gov/vuln/detail/CVE-2026-54399	WEB
	https://nvd.nist.gov/vuln/detail/CVE-2026-54428	WEB
	https://nvd.nist.gov/vuln/detail/CVE-2026-54512	WEB
	https://nvd.nist.gov/vuln/detail/CVE-2026-54513	WEB
	https://nvd.nist.gov/vuln/detail/CVE-2026-54514	WEB
	https://nvd.nist.gov/vuln/detail/CVE-2026-54515	WEB
	https://nvd.nist.gov/vuln/detail/CVE-2026-54516	WEB
	https://nvd.nist.gov/vuln/detail/CVE-2026-54517	WEB
	https://nvd.nist.gov/vuln/detail/CVE-2026-54518	WEB
	https://nvd.nist.gov/vuln/detail/CVE-2026-5588	WEB
	https://nvd.nist.gov/vuln/detail/CVE-2026-9828	WEB

JSON

To clipboard

{
  "affected": [
    {
      "package": {
        "ecosystem": "CleanStart",
        "name": "apache-nifi"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "0"
            },
            {
              "fixed": "2.9.0-r1"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ]
    }
  ],
  "credits": [],
  "database_specific": {},
  "details": "Multiple security vulnerabilities affect the apache-nifi package. These issues are resolved in later releases. See references for individual vulnerability details.",
  "id": "CLEANSTART-2026-WT54034",
  "modified": "2026-07-15T06:27:47Z",
  "published": "2026-07-21T07:50:38.904956Z",
  "references": [
    {
      "type": "ADVISORY",
      "url": "https://github.com/cleanstart-dev/cleanstart-security-advisories/tree/main/advisories/2026/CLEANSTART-2026-WT54034.json"
    },
    {
      "type": "WEB",
      "url": "https://osv.dev/vulnerability/CVE-2025-8671"
    },
    {
      "type": "WEB",
      "url": "https://osv.dev/vulnerability/CVE-2026-0636"
    },
    {
      "type": "WEB",
      "url": "https://osv.dev/vulnerability/CVE-2026-10532"
    },
    {
      "type": "WEB",
      "url": "https://osv.dev/vulnerability/CVE-2026-13006"
    },
    {
      "type": "WEB",
      "url": "https://osv.dev/vulnerability/CVE-2026-1605"
    },
    {
      "type": "WEB",
      "url": "https://osv.dev/vulnerability/CVE-2026-22732"
    },
    {
      "type": "WEB",
      "url": "https://osv.dev/vulnerability/CVE-2026-2332"
    },
    {
      "type": "WEB",
      "url": "https://osv.dev/vulnerability/CVE-2026-24281"
    },
    {
      "type": "WEB",
      "url": "https://osv.dev/vulnerability/CVE-2026-33870"
    },
    {
      "type": "WEB",
      "url": "https://osv.dev/vulnerability/CVE-2026-33871"
    },
    {
      "type": "WEB",
      "url": "https://osv.dev/vulnerability/CVE-2026-3505"
    },
    {
      "type": "WEB",
      "url": "https://osv.dev/vulnerability/CVE-2026-40983"
    },
    {
      "type": "WEB",
      "url": "https://osv.dev/vulnerability/CVE-2026-40984"
    },
    {
      "type": "WEB",
      "url": "https://osv.dev/vulnerability/CVE-2026-54399"
    },
    {
      "type": "WEB",
      "url": "https://osv.dev/vulnerability/CVE-2026-54428"
    },
    {
      "type": "WEB",
      "url": "https://osv.dev/vulnerability/CVE-2026-54512"
    },
    {
      "type": "WEB",
      "url": "https://osv.dev/vulnerability/CVE-2026-54513"
    },
    {
      "type": "WEB",
      "url": "https://osv.dev/vulnerability/CVE-2026-54514"
    },
    {
      "type": "WEB",
      "url": "https://osv.dev/vulnerability/CVE-2026-54515"
    },
    {
      "type": "WEB",
      "url": "https://osv.dev/vulnerability/CVE-2026-54516"
    },
    {
      "type": "WEB",
      "url": "https://osv.dev/vulnerability/CVE-2026-54517"
    },
    {
      "type": "WEB",
      "url": "https://osv.dev/vulnerability/CVE-2026-54518"
    },
    {
      "type": "WEB",
      "url": "https://osv.dev/vulnerability/CVE-2026-5588"
    },
    {
      "type": "WEB",
      "url": "https://osv.dev/vulnerability/CVE-2026-9828"
    },
    {
      "type": "WEB",
      "url": "https://osv.dev/vulnerability/ghsa-355h-qmc2-wpwf"
    },
    {
      "type": "WEB",
      "url": "https://osv.dev/vulnerability/ghsa-3677-xxcr-wjqv"
    },
    {
      "type": "WEB",
      "url": "https://osv.dev/vulnerability/ghsa-38f8-5428-x5cv"
    },
    {
      "type": "WEB",
      "url": "https://osv.dev/vulnerability/ghsa-3qp7-7mw8-wx86"
    },
    {
      "type": "WEB",
      "url": "https://osv.dev/vulnerability/ghsa-45q3-82m4-75jr"
    },
    {
      "type": "WEB",
      "url": "https://osv.dev/vulnerability/ghsa-563q-j3cm-6jxm"
    },
    {
      "type": "WEB",
      "url": "https://osv.dev/vulnerability/ghsa-57rv-r2g8-2cj3"
    },
    {
      "type": "WEB",
      "url": "https://osv.dev/vulnerability/ghsa-5pvg-856g-cp85"
    },
    {
      "type": "WEB",
      "url": "https://osv.dev/vulnerability/ghsa-5x3r-wrvg-rp6q"
    },
    {
      "type": "WEB",
      "url": "https://osv.dev/vulnerability/ghsa-676x-f7gg-47vc"
    },
    {
      "type": "WEB",
      "url": "https://osv.dev/vulnerability/ghsa-72hv-8253-57qq"
    },
    {
      "type": "WEB",
      "url": "https://osv.dev/vulnerability/ghsa-c2gf-v879-257j"
    },
    {
      "type": "WEB",
      "url": "https://osv.dev/vulnerability/ghsa-c3fc-8qff-9hwx"
    },
    {
      "type": "WEB",
      "url": "https://osv.dev/vulnerability/ghsa-c653-97m9-rcg9"
    },
    {
      "type": "WEB",
      "url": "https://osv.dev/vulnerability/ghsa-cj8j-37rh-8475"
    },
    {
      "type": "WEB",
      "url": "https://osv.dev/vulnerability/ghsa-cm33-6792-r9fm"
    },
    {
      "type": "WEB",
      "url": "https://osv.dev/vulnerability/ghsa-cmm3-54f8-px4j"
    },
    {
      "type": "WEB",
      "url": "https://osv.dev/vulnerability/ghsa-cq4q-cv5g-r8q5"
    },
    {
      "type": "WEB",
      "url": "https://osv.dev/vulnerability/ghsa-cvc6-q2cp-2xhw"
    },
    {
      "type": "WEB",
      "url": "https://osv.dev/vulnerability/ghsa-f6hv-jmp6-3vwv"
    },
    {
      "type": "WEB",
      "url": "https://osv.dev/vulnerability/ghsa-hvcg-qmg6-jm4c"
    },
    {
      "type": "WEB",
      "url": "https://osv.dev/vulnerability/ghsa-m4cv-j2px-7723"
    },
    {
      "type": "WEB",
      "url": "https://osv.dev/vulnerability/ghsa-mj4r-2hfc-f8p6"
    },
    {
      "type": "WEB",
      "url": "https://osv.dev/vulnerability/ghsa-qqpg-mvqg-649v"
    },
    {
      "type": "WEB",
      "url": "https://osv.dev/vulnerability/ghsa-rwm7-x88c-3g2p"
    },
    {
      "type": "WEB",
      "url": "https://osv.dev/vulnerability/ghsa-v8h7-rr48-vmmv"
    },
    {
      "type": "WEB",
      "url": "https://osv.dev/vulnerability/ghsa-vxf7-qj7q-83fh"
    },
    {
      "type": "WEB",
      "url": "https://osv.dev/vulnerability/ghsa-w573-9ffj-6ff9"
    },
    {
      "type": "WEB",
      "url": "https://osv.dev/vulnerability/ghsa-wg6q-6289-32hp"
    },
    {
      "type": "WEB",
      "url": "https://osv.dev/vulnerability/ghsa-x2wq-9x2f-fhj7"
    },
    {
      "type": "WEB",
      "url": "https://osv.dev/vulnerability/ghsa-x44p-gvrj-pj2r"
    },
    {
      "type": "WEB",
      "url": "https://osv.dev/vulnerability/ghsa-x4gw-5cx5-pgmh"
    },
    {
      "type": "WEB",
      "url": "https://osv.dev/vulnerability/ghsa-xmv7-r254-6q78"
    },
    {
      "type": "WEB",
      "url": "https://osv.dev/vulnerability/ghsa-xxqh-mfjm-7mv9"
    },
    {
      "type": "WEB",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2025-8671"
    },
    {
      "type": "WEB",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-0636"
    },
    {
      "type": "WEB",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-10532"
    },
    {
      "type": "WEB",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-13006"
    },
    {
      "type": "WEB",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-1605"
    },
    {
      "type": "WEB",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-22732"
    },
    {
      "type": "WEB",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-2332"
    },
    {
      "type": "WEB",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-24281"
    },
    {
      "type": "WEB",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-33870"
    },
    {
      "type": "WEB",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-33871"
    },
    {
      "type": "WEB",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-3505"
    },
    {
      "type": "WEB",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-40983"
    },
    {
      "type": "WEB",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-40984"
    },
    {
      "type": "WEB",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-54399"
    },
    {
      "type": "WEB",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-54428"
    },
    {
      "type": "WEB",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-54512"
    },
    {
      "type": "WEB",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-54513"
    },
    {
      "type": "WEB",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-54514"
    },
    {
      "type": "WEB",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-54515"
    },
    {
      "type": "WEB",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-54516"
    },
    {
      "type": "WEB",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-54517"
    },
    {
      "type": "WEB",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-54518"
    },
    {
      "type": "WEB",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-5588"
    },
    {
      "type": "WEB",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-9828"
    }
  ],
  "related": [],
  "schema_version": "1.7.3",
  "summary": "Security fixes for CVE-2025-8671, CVE-2026-0636, CVE-2026-10532, CVE-2026-13006, CVE-2026-1605, CVE-2026-22732, CVE-2026-2332, CVE-2026-24281, CVE-2026-33870, CVE-2026-33871, CVE-2026-3505, CVE-2026-40983, CVE-2026-40984, CVE-2026-54399, CVE-2026-54428, CVE-2026-54512, CVE-2026-54513, CVE-2026-54514, CVE-2026-54515, CVE-2026-54516, CVE-2026-54517, CVE-2026-54518, CVE-2026-5588, CVE-2026-9828, ghsa-355h-qmc2-wpwf, ghsa-3677-xxcr-wjqv, ghsa-38f8-5428-x5cv, ghsa-3qp7-7mw8-wx86, ghsa-45q3-82m4-75jr, ghsa-563q-j3cm-6jxm, ghsa-57rv-r2g8-2cj3, ghsa-5pvg-856g-cp85, ghsa-5x3r-wrvg-rp6q, ghsa-676x-f7gg-47vc, ghsa-72hv-8253-57qq, ghsa-c2gf-v879-257j, ghsa-c3fc-8qff-9hwx, ghsa-c653-97m9-rcg9, ghsa-cj8j-37rh-8475, ghsa-cm33-6792-r9fm, ghsa-cmm3-54f8-px4j, ghsa-cq4q-cv5g-r8q5, ghsa-cvc6-q2cp-2xhw, ghsa-f6hv-jmp6-3vwv, ghsa-hvcg-qmg6-jm4c, ghsa-m4cv-j2px-7723, ghsa-mj4r-2hfc-f8p6, ghsa-qqpg-mvqg-649v, ghsa-rwm7-x88c-3g2p, ghsa-v8h7-rr48-vmmv, ghsa-vxf7-qj7q-83fh, ghsa-w573-9ffj-6ff9, ghsa-wg6q-6289-32hp, ghsa-x2wq-9x2f-fhj7, ghsa-x44p-gvrj-pj2r, ghsa-x4gw-5cx5-pgmh, ghsa-xmv7-r254-6q78, ghsa-xxqh-mfjm-7mv9 applied in versions: 2.10.0-r1, 2.10.0-r2, 2.7.2-r0, 2.7.2-r2, 2.9.0-r0, 2.9.0-r1",
  "upstream": [
    "CVE-2025-8671",
    "CVE-2026-0636",
    "CVE-2026-10532",
    "CVE-2026-13006",
    "CVE-2026-1605",
    "CVE-2026-22732",
    "CVE-2026-2332",
    "CVE-2026-24281",
    "CVE-2026-33870",
    "CVE-2026-33871",
    "CVE-2026-3505",
    "CVE-2026-40983",
    "CVE-2026-40984",
    "CVE-2026-54399",
    "CVE-2026-54428",
    "CVE-2026-54512",
    "CVE-2026-54513",
    "CVE-2026-54514",
    "CVE-2026-54515",
    "CVE-2026-54516",
    "CVE-2026-54517",
    "CVE-2026-54518",
    "CVE-2026-5588",
    "CVE-2026-9828",
    "ghsa-355h-qmc2-wpwf",
    "ghsa-3677-xxcr-wjqv",
    "ghsa-38f8-5428-x5cv",
    "ghsa-3qp7-7mw8-wx86",
    "ghsa-45q3-82m4-75jr",
    "ghsa-563q-j3cm-6jxm",
    "ghsa-57rv-r2g8-2cj3",
    "ghsa-5pvg-856g-cp85",
    "ghsa-5x3r-wrvg-rp6q",
    "ghsa-676x-f7gg-47vc",
    "ghsa-72hv-8253-57qq",
    "ghsa-c2gf-v879-257j",
    "ghsa-c3fc-8qff-9hwx",
    "ghsa-c653-97m9-rcg9",
    "ghsa-cj8j-37rh-8475",
    "ghsa-cm33-6792-r9fm",
    "ghsa-cmm3-54f8-px4j",
    "ghsa-cq4q-cv5g-r8q5",
    "ghsa-cvc6-q2cp-2xhw",
    "ghsa-f6hv-jmp6-3vwv",
    "ghsa-hvcg-qmg6-jm4c",
    "ghsa-m4cv-j2px-7723",
    "ghsa-mj4r-2hfc-f8p6",
    "ghsa-qqpg-mvqg-649v",
    "ghsa-rwm7-x88c-3g2p",
    "ghsa-v8h7-rr48-vmmv",
    "ghsa-vxf7-qj7q-83fh",
    "ghsa-w573-9ffj-6ff9",
    "ghsa-wg6q-6289-32hp",
    "ghsa-x2wq-9x2f-fhj7",
    "ghsa-x44p-gvrj-pj2r",
    "ghsa-x4gw-5cx5-pgmh",
    "ghsa-xmv7-r254-6q78",
    "ghsa-xxqh-mfjm-7mv9"
  ]
}

cleanstart-2026-zg52936

Vulnerability from cleanstart

Published

2026-07-30 07:10

Modified

2026-07-30 09:35

Summary

Security fixes in apache-nifi 2.10.0-r1

Details

Package apache-nifi version 2.10.0-r1 fixes 31 vulnerabilities: ghsa-x4gw-5cx5-pgmh, ghsa-3qp7-7mw8-wx86, ghsa-f6hv-jmp6-3vwv, ghsa-c2gf-v879-257j, ghsa-cm33-6792-r9fm...

References

URL

Type

https://github.com/apache/nifi

WEB

JSON

To clipboard

{
  "affected": [
    {
      "package": {
        "ecosystem": "Alpine",
        "name": "apache-nifi"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "0"
            },
            {
              "fixed": "2.10.0-r1"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ],
      "versions": [
        "2.10.0-r1"
      ]
    }
  ],
  "credits": [],
  "database_specific": {},
  "details": "Package apache-nifi version 2.10.0-r1 fixes 31 vulnerabilities: ghsa-x4gw-5cx5-pgmh, ghsa-3qp7-7mw8-wx86, ghsa-f6hv-jmp6-3vwv, ghsa-c2gf-v879-257j, ghsa-cm33-6792-r9fm...",
  "id": "CLEANSTART-2026-ZG52936",
  "modified": "2026-07-30T09:35:42Z",
  "published": "2026-07-30T07:10:53Z",
  "references": [
    {
      "type": "WEB",
      "url": "https://github.com/apache/nifi"
    }
  ],
  "related": [],
  "schema_version": "1.7.3",
  "summary": "Security fixes in apache-nifi 2.10.0-r1",
  "upstream": [
    "ghsa-x4gw-5cx5-pgmh",
    "ghsa-3qp7-7mw8-wx86",
    "ghsa-f6hv-jmp6-3vwv",
    "ghsa-c2gf-v879-257j",
    "ghsa-cm33-6792-r9fm",
    "ghsa-mj4r-2hfc-f8p6",
    "ghsa-rwm7-x88c-3g2p",
    "ghsa-5x3r-wrvg-rp6q",
    "ghsa-xmv7-r254-6q78",
    "ghsa-57rv-r2g8-2cj3",
    "ghsa-xxqh-mfjm-7mv9",
    "ghsa-m4cv-j2px-7723",
    "ghsa-5pvg-856g-cp85",
    "ghsa-676x-f7gg-47vc",
    "ghsa-cmm3-54f8-px4j",
    "ghsa-563q-j3cm-6jxm",
    "ghsa-v8h7-rr48-vmmv",
    "ghsa-c653-97m9-rcg9",
    "ghsa-38f8-5428-x5cv",
    "ghsa-45q3-82m4-75jr",
    "ghsa-hvcg-qmg6-jm4c",
    "ghsa-cq4q-cv5g-r8q5",
    "ghsa-w573-9ffj-6ff9",
    "CVE-2026-10532",
    "CVE-2026-9828",
    "CVE-2026-13006",
    "CVE-2026-54399",
    "CVE-2026-54428",
    "CVE-2025-8671",
    "CVE-2026-40983",
    "CVE-2026-40984"
  ]
}

FKIE_CVE-2026-40984

Vulnerability from fkie_nvd - Published: 2026-06-09 05:16 - Updated: 2026-08-13 13:18

Severity

7.5 (High) - CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
7.5 (High) - CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

Summary

References

	URL	Tags
	security@vmware.com	https://spring.io/security/cve-2026-40984
	0b0ca135-0b70-47e7-9f44-1890c2a1c46c	https://access.redhat.com/errata/RHSA-2026:36839
	0b0ca135-0b70-47e7-9f44-1890c2a1c46c	https://access.redhat.com/errata/RHSA-2026:37390
	0b0ca135-0b70-47e7-9f44-1890c2a1c46c	https://access.redhat.com/errata/RHSA-2026:41951
	0b0ca135-0b70-47e7-9f44-1890c2a1c46c	https://access.redhat.com/errata/RHSA-2026:50848
	0b0ca135-0b70-47e7-9f44-1890c2a1c46c	https://access.redhat.com/errata/RHSA-2026:50849
	0b0ca135-0b70-47e7-9f44-1890c2a1c46c	https://access.redhat.com/errata/RHSA-2026:54435
	0b0ca135-0b70-47e7-9f44-1890c2a1c46c	https://access.redhat.com/security/cve/CVE-2026-40984
	0b0ca135-0b70-47e7-9f44-1890c2a1c46c	https://bugzilla.redhat.com/show_bug.cgi?id=2486716
	0b0ca135-0b70-47e7-9f44-1890c2a1c46c	https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-40984.json

Impacted products

	Vendor	Product	Version

JSON

To clipboard

{
  "affected": [
    {
      "affectedData": [
        {
          "defaultStatus": "unaffected",
          "packageName": "micrometer-core",
          "product": "Micrometer",
          "vendor": "Spring",
          "versions": [
            {
              "lessThan": "1.16.5.1",
              "status": "affected",
              "version": "1.16.0",
              "versionType": "custom"
            },
            {
              "lessThan": "1.15.11.1",
              "status": "affected",
              "version": "1.15.0",
              "versionType": "custom"
            },
            {
              "lessThan": "1.14.16",
              "status": "affected",
              "version": "1.14.0",
              "versionType": "custom"
            },
            {
              "lessThan": "1.13.19",
              "status": "affected",
              "version": "1.13.0",
              "versionType": "custom"
            },
            {
              "lessThan": "1.9.18",
              "status": "affected",
              "version": "1.9.0",
              "versionType": "custom"
            }
          ]
        },
        {
          "defaultStatus": "unaffected",
          "packageName": "micrometer-jetty11",
          "product": "Micrometer",
          "vendor": "Spring",
          "versions": [
            {
              "lessThan": "1.16.5.1",
              "status": "affected",
              "version": "1.16.0",
              "versionType": "custom"
            },
            {
              "lessThan": "1.15.11.1",
              "status": "affected",
              "version": "1.15.0",
              "versionType": "custom"
            },
            {
              "lessThan": "1.14.16",
              "status": "affected",
              "version": "1.14.0",
              "versionType": "custom"
            },
            {
              "lessThan": "1.13.19",
              "status": "affected",
              "version": "1.13.0",
              "versionType": "custom"
            }
          ]
        },
        {
          "defaultStatus": "unaffected",
          "packageName": "micrometer-jetty12",
          "product": "Micrometer",
          "vendor": "Spring",
          "versions": [
            {
              "lessThan": "1.16.6",
              "status": "affected",
              "version": "1.16.0",
              "versionType": "custom"
            },
            {
              "lessThan": "1.15.11.",
              "status": "affected",
              "version": "1.15.0",
              "versionType": "custom"
            },
            {
              "lessThan": "1.14.15.1",
              "status": "affected",
              "version": "1.14.0",
              "versionType": "custom"
            },
            {
              "lessThan": "1.13.19",
              "status": "affected",
              "version": "1.13.0",
              "versionType": "custom"
            }
          ]
        }
      ],
      "source": "security@vmware.com"
    },
    {
      "affectedData": [
        {
          "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
          "cpes": [
            "cpe:/a:redhat:apache_camel_spring_boot:4.18"
          ],
          "defaultStatus": "unaffected",
          "packageName": "micrometer-core",
          "product": "Red Hat build of Apache Camel 4.18.1.P1 for Spring Boot 3.5.16",
          "vendor": "Red Hat"
        },
        {
          "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
          "cpes": [
            "cpe:/a:redhat:apache_camel_quarkus:3.33"
          ],
          "defaultStatus": "unaffected",
          "packageName": "micrometer-core",
          "product": "Red Hat Build of Apache Camel 4.18 for Quarkus 3.33",
          "vendor": "Red Hat"
        },
        {
          "collectionURL": "https://catalog.redhat.com/software/containers/",
          "cpes": [
            "cpe:/a:redhat:build_keycloak:26.6::el9"
          ],
          "defaultStatus": "affected",
          "packageName": "rhbk/keycloak-operator-bundle",
          "product": "Red Hat build of Keycloak 26.6",
          "vendor": "Red Hat",
          "versions": [
            {
              "lessThan": "*",
              "status": "unaffected",
              "version": "26.6.5-1",
              "versionType": "rpm"
            }
          ]
        },
        {
          "collectionURL": "https://catalog.redhat.com/software/containers/",
          "cpes": [
            "cpe:/a:redhat:build_keycloak:26.6::el9"
          ],
          "defaultStatus": "affected",
          "packageName": "rhbk/keycloak-rhel9",
          "product": "Red Hat build of Keycloak 26.6",
          "vendor": "Red Hat",
          "versions": [
            {
              "lessThan": "*",
              "status": "unaffected",
              "version": "26.6-11",
              "versionType": "rpm"
            }
          ]
        },
        {
          "collectionURL": "https://catalog.redhat.com/software/containers/",
          "cpes": [
            "cpe:/a:redhat:build_keycloak:26.6::el9"
          ],
          "defaultStatus": "affected",
          "packageName": "rhbk/keycloak-rhel9-operator",
          "product": "Red Hat build of Keycloak 26.6",
          "vendor": "Red Hat",
          "versions": [
            {
              "lessThan": "*",
              "status": "unaffected",
              "version": "26.6-11",
              "versionType": "rpm"
            }
          ]
        },
        {
          "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
          "cpes": [
            "cpe:/a:redhat:build_keycloak:26.6::el9"
          ],
          "defaultStatus": "unaffected",
          "packageName": "micrometer-core",
          "product": "Red Hat build of Keycloak 26.6.5",
          "vendor": "Red Hat"
        },
        {
          "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
          "cpes": [
            "cpe:/a:redhat:build_keycloak:26.6::el9"
          ],
          "defaultStatus": "unaffected",
          "packageName": "rhbk/keycloak-rhel9",
          "product": "Red Hat build of Keycloak 26.6.5",
          "vendor": "Red Hat"
        },
        {
          "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
          "cpes": [
            "cpe:/a:redhat:build_keycloak:26.6::el9"
          ],
          "defaultStatus": "affected",
          "packageName": "rhbk/keycloak",
          "product": "Red Hat build of Keycloak 26.6.5",
          "vendor": "Red Hat",
          "versions": [
            {
              "lessThan": "*",
              "status": "unaffected",
              "version": "rhel9-operator",
              "versionType": "rpm"
            }
          ]
        },
        {
          "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
          "cpes": [
            "cpe:/a:redhat:build_keycloak:26.6::el9"
          ],
          "defaultStatus": "affected",
          "packageName": "rhbk-openshift-rhel9/rhbk",
          "product": "Red Hat build of Keycloak 26.6.5",
          "vendor": "Red Hat",
          "versions": [
            {
              "lessThan": "*",
              "status": "unaffected",
              "version": "openshift-rhel9",
              "versionType": "rpm"
            }
          ]
        },
        {
          "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
          "cpes": [
            "cpe:/a:redhat:build_keycloak:26.6::el9"
          ],
          "defaultStatus": "affected",
          "packageName": "rhbk-rhel9-operator/rhbk",
          "product": "Red Hat build of Keycloak 26.6.5",
          "vendor": "Red Hat",
          "versions": [
            {
              "lessThan": "*",
              "status": "unaffected",
              "version": "rhel9-operator",
              "versionType": "rpm"
            }
          ]
        },
        {
          "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
          "cpes": [
            "cpe:/a:redhat:jboss_data_grid:8"
          ],
          "defaultStatus": "unaffected",
          "packageName": "micrometer-core",
          "product": "Red Hat Data Grid 8.6.2",
          "vendor": "Red Hat"
        },
        {
          "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
          "cpes": [
            "cpe:/a:redhat:amq_broker:7"
          ],
          "defaultStatus": "affected",
          "packageName": "micrometer-core",
          "product": "Red Hat AMQ Broker 7",
          "vendor": "Red Hat"
        },
        {
          "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
          "cpes": [
            "cpe:/a:redhat:amq_clients:2023"
          ],
          "defaultStatus": "affected",
          "packageName": "micrometer-core",
          "product": "Red Hat AMQ Clients",
          "vendor": "Red Hat"
        },
        {
          "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
          "cpes": [
            "cpe:/a:redhat:camel_quarkus:3"
          ],
          "defaultStatus": "affected",
          "packageName": "micrometer-core",
          "product": "Red Hat build of Apache Camel 4 for Quarkus 3",
          "vendor": "Red Hat"
        },
        {
          "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
          "cpes": [
            "cpe:/a:redhat:apache_camel_hawtio:4"
          ],
          "defaultStatus": "affected",
          "packageName": "micrometer-core",
          "product": "Red Hat build of Apache Camel - HawtIO 4",
          "vendor": "Red Hat"
        },
        {
          "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
          "cpes": [
            "cpe:/a:redhat:apicurio_registry:3"
          ],
          "defaultStatus": "affected",
          "packageName": "micrometer-core",
          "product": "Red Hat build of Apicurio Registry 3",
          "vendor": "Red Hat"
        },
        {
          "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
          "cpes": [
            "cpe:/a:redhat:debezium:3"
          ],
          "defaultStatus": "affected",
          "packageName": "micrometer-core",
          "product": "Red Hat build of Debezium 3",
          "vendor": "Red Hat"
        },
        {
          "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
          "cpes": [
            "cpe:/a:redhat:optaplanner:::el6"
          ],
          "defaultStatus": "affected",
          "packageName": "micrometer-core",
          "product": "Red Hat build of OptaPlanner 8",
          "vendor": "Red Hat"
        },
        {
          "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
          "cpes": [
            "cpe:/a:redhat:quarkus:3"
          ],
          "defaultStatus": "affected",
          "packageName": "micrometer-core",
          "product": "Red Hat build of Quarkus",
          "vendor": "Red Hat"
        },
        {
          "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
          "cpes": [
            "cpe:/a:redhat:jboss_fuse:7"
          ],
          "defaultStatus": "unknown",
          "packageName": "micrometer-core",
          "product": "Red Hat Fuse 7",
          "vendor": "Red Hat"
        },
        {
          "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
          "cpes": [
            "cpe:/a:redhat:jbosseapxp"
          ],
          "defaultStatus": "affected",
          "packageName": "micrometer-core",
          "product": "Red Hat JBoss Enterprise Application Platform Expansion Pack",
          "vendor": "Red Hat"
        },
        {
          "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
          "cpes": [
            "cpe:/a:redhat:openshift_ai"
          ],
          "defaultStatus": "unaffected",
          "packageName": "rhoai/odh-trustyai-service-rhel9",
          "product": "Red Hat OpenShift AI (RHOAI)",
          "vendor": "Red Hat"
        },
        {
          "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
          "cpes": [
            "cpe:/a:redhat:openshift_devspaces:3"
          ],
          "defaultStatus": "affected",
          "packageName": "devspaces/openvsx-rhel9",
          "product": "Red Hat OpenShift Dev Spaces",
          "vendor": "Red Hat"
        },
        {
          "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
          "cpes": [
            "cpe:/a:redhat:openshift_devspaces:3"
          ],
          "defaultStatus": "affected",
          "packageName": "devspaces/pluginregistry-rhel9",
          "product": "Red Hat OpenShift Dev Spaces",
          "vendor": "Red Hat"
        },
        {
          "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
          "cpes": [
            "cpe:/a:redhat:openshift_devspaces:3"
          ],
          "defaultStatus": "unknown",
          "packageName": "devspaces/server-rhel9",
          "product": "Red Hat OpenShift Dev Spaces",
          "vendor": "Red Hat"
        },
        {
          "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
          "cpes": [
            "cpe:/a:redhat:jboss_enterprise_bpms_platform:7"
          ],
          "defaultStatus": "affected",
          "packageName": "micrometer-core",
          "product": "Red Hat Process Automation 7",
          "vendor": "Red Hat"
        },
        {
          "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
          "cpes": [
            "cpe:/a:redhat:amq_streams:2"
          ],
          "defaultStatus": "affected",
          "packageName": "micrometer-core",
          "product": "streams for Apache Kafka 2",
          "vendor": "Red Hat"
        },
        {
          "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
          "cpes": [
            "cpe:/a:redhat:amq_streams:3"
          ],
          "defaultStatus": "affected",
          "packageName": "micrometer-core",
          "product": "streams for Apache Kafka 3",
          "vendor": "Red Hat"
        }
      ],
      "source": "0b0ca135-0b70-47e7-9f44-1890c2a1c46c"
    }
  ],
  "cveTags": [],
  "descriptions": [
    {
      "lang": "en",
      "value": "In Micrometer, it is possible for a user to provide specially crafted HTTP requests that may cause a denial-of-service (DoS) condition.\n\nAffected versions:\nmicrometer-core 1.16.0 through 1.16.5; 1.15.0 through 1.15.11; 1.14.0 through 1.14.15; 1.13.0 through 1.13.18; 1.9.0 through 1.9.17.\nmicrometer-jetty11 1.16.0 through 1.16.5; 1.15.0 through 1.15.11; 1.14.0 through 1.14.15; 1.13.0 through 1.13.18.\nmicrometer-jetty12 1.16.0 through 1.16.5; 1.15.0 through 1.15.11; 1.14.0 through 1.14.15; 1.13.0 through 1.13.18."
    },
    {
      "lang": "es",
      "value": "En Micrometer, es posible que un usuario proporcione solicitudes HTTP especialmente dise\u00f1adas que pueden causar una condici\u00f3n de denegaci\u00f3n de servicio (DoS).\n\nVersiones afectadas:\nmicrometer-core 1.16.0 a 1.16.5; 1.15.0 a 1.15.11; 1.14.0 a 1.14.15; 1.13.0 a 1.13.18; 1.9.0 a 1.9.17.\nmicrometer-jetty11 1.16.0 a 1.16.5; 1.15.0 a 1.15.11; 1.14.0 a 1.14.15; 1.13.0 a 1.13.18.\nmicrometer-jetty12 1.16.0 a 1.16.5; 1.15.0 a 1.15.11; 1.14.0 a 1.14.15; 1.13.0 a 1.13.18."
    }
  ],
  "id": "CVE-2026-40984",
  "lastModified": "2026-08-13T13:18:47.123",
  "metrics": {
    "cvssMetricV31": [
      {
        "cvssData": {
          "attackComplexity": "LOW",
          "attackVector": "NETWORK",
          "availabilityImpact": "HIGH",
          "baseScore": 7.5,
          "baseSeverity": "HIGH",
          "confidentialityImpact": "NONE",
          "integrityImpact": "NONE",
          "privilegesRequired": "NONE",
          "scope": "UNCHANGED",
          "userInteraction": "NONE",
          "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
          "version": "3.1"
        },
        "exploitabilityScore": 3.9,
        "impactScore": 3.6,
        "source": "security@vmware.com",
        "type": "Secondary"
      },
      {
        "cvssData": {
          "attackComplexity": "LOW",
          "attackVector": "NETWORK",
          "availabilityImpact": "HIGH",
          "baseScore": 7.5,
          "baseSeverity": "HIGH",
          "confidentialityImpact": "NONE",
          "integrityImpact": "NONE",
          "privilegesRequired": "NONE",
          "scope": "UNCHANGED",
          "userInteraction": "NONE",
          "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
          "version": "3.1"
        },
        "exploitabilityScore": 3.9,
        "impactScore": 3.6,
        "source": "0b0ca135-0b70-47e7-9f44-1890c2a1c46c",
        "type": "Secondary"
      }
    ],
    "ssvcV203": [
      {
        "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
        "ssvcData": {
          "id": "CVE-2026-40984",
          "options": [
            {
              "exploitation": "none"
            },
            {
              "automatable": "yes"
            },
            {
              "technicalImpact": "partial"
            }
          ],
          "role": "CISA Coordinator",
          "timestamp": "2026-06-09T13:49:55.899071Z",
          "version": "2.0.3"
        }
      }
    ]
  },
  "published": "2026-06-09T05:16:34.780",
  "references": [
    {
      "source": "security@vmware.com",
      "url": "https://spring.io/security/cve-2026-40984"
    },
    {
      "source": "0b0ca135-0b70-47e7-9f44-1890c2a1c46c",
      "url": "https://access.redhat.com/errata/RHSA-2026:36839"
    },
    {
      "source": "0b0ca135-0b70-47e7-9f44-1890c2a1c46c",
      "url": "https://access.redhat.com/errata/RHSA-2026:37390"
    },
    {
      "source": "0b0ca135-0b70-47e7-9f44-1890c2a1c46c",
      "url": "https://access.redhat.com/errata/RHSA-2026:41951"
    },
    {
      "source": "0b0ca135-0b70-47e7-9f44-1890c2a1c46c",
      "url": "https://access.redhat.com/errata/RHSA-2026:50848"
    },
    {
      "source": "0b0ca135-0b70-47e7-9f44-1890c2a1c46c",
      "url": "https://access.redhat.com/errata/RHSA-2026:50849"
    },
    {
      "source": "0b0ca135-0b70-47e7-9f44-1890c2a1c46c",
      "url": "https://access.redhat.com/errata/RHSA-2026:54435"
    },
    {
      "source": "0b0ca135-0b70-47e7-9f44-1890c2a1c46c",
      "url": "https://access.redhat.com/security/cve/CVE-2026-40984"
    },
    {
      "source": "0b0ca135-0b70-47e7-9f44-1890c2a1c46c",
      "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2486716"
    },
    {
      "source": "0b0ca135-0b70-47e7-9f44-1890c2a1c46c",
      "url": "https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-40984.json"
    }
  ],
  "sourceIdentifier": "security@vmware.com",
  "vulnStatus": "Awaiting Analysis",
  "weaknesses": [
    {
      "description": [
        {
          "lang": "en",
          "value": "CWE-400"
        }
      ],
      "source": "security@vmware.com",
      "type": "Secondary"
    },
    {
      "description": [
        {
          "lang": "en",
          "value": "CWE-770"
        }
      ],
      "source": "0b0ca135-0b70-47e7-9f44-1890c2a1c46c",
      "type": "Secondary"
    }
  ]
}

GHSA-G3PR-3P32-FP23

Vulnerability from github – Published: 2026-06-09 06:31 – Updated: 2026-08-13 15:34

Summary

Micrometer HTTP server instrumentations DoS

Details

In Micrometer, it is possible for a user to provide specially crafted HTTP requests that may cause a denial-of-service (DoS) condition.

Affected versions: micrometer-core 1.16.0 through 1.16.5; 1.15.0 through 1.15.11; 1.14.0 through 1.14.15; 1.13.0 through 1.13.18; 1.9.0 through 1.9.17. micrometer-jetty11 1.16.0 through 1.16.5; 1.15.0 through 1.15.11; 1.14.0 through 1.14.15; 1.13.0 through 1.13.18. micrometer-jetty12 1.16.0 through 1.16.5; 1.15.0 through 1.15.11; 1.14.0 through 1.14.15; 1.13.0 through 1.13.18.

Severity

7.5 (High)


                  
                    CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

Show details on source website

JSON

To clipboard

{
  "affected": [
    {
      "database_specific": {
        "last_known_affected_version_range": "\u003c= 1.16.5"
      },
      "package": {
        "ecosystem": "Maven",
        "name": "io.micrometer:micrometer-core"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "1.16.0"
            },
            {
              "fixed": "1.16.6"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ]
    },
    {
      "database_specific": {
        "last_known_affected_version_range": "\u003c= 1.15.11"
      },
      "package": {
        "ecosystem": "Maven",
        "name": "io.micrometer:micrometer-core"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "1.15.0"
            },
            {
              "fixed": "1.15.12"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ]
    },
    {
      "package": {
        "ecosystem": "Maven",
        "name": "io.micrometer:micrometer-core"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "1.14.0"
            },
            {
              "last_affected": "1.14.14"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ]
    },
    {
      "package": {
        "ecosystem": "Maven",
        "name": "io.micrometer:micrometer-core"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "1.10.0"
            },
            {
              "last_affected": "1.13.15"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ]
    },
    {
      "package": {
        "ecosystem": "Maven",
        "name": "io.micrometer:micrometer-core"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "0"
            },
            {
              "last_affected": "1.9.17"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ]
    },
    {
      "database_specific": {
        "last_known_affected_version_range": "\u003c= 1.16.5"
      },
      "package": {
        "ecosystem": "Maven",
        "name": "io.micrometer:micrometer-jetty12"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "1.16.0"
            },
            {
              "fixed": "1.16.6"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ]
    },
    {
      "database_specific": {
        "last_known_affected_version_range": "\u003c= 1.15.11"
      },
      "package": {
        "ecosystem": "Maven",
        "name": "io.micrometer:micrometer-jetty12"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "1.15.0"
            },
            {
              "fixed": "1.15.12"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ]
    },
    {
      "package": {
        "ecosystem": "Maven",
        "name": "io.micrometer:micrometer-jetty12"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "1.14.0"
            },
            {
              "last_affected": "1.14.14"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ]
    },
    {
      "package": {
        "ecosystem": "Maven",
        "name": "io.micrometer:micrometer-jetty12"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "0"
            },
            {
              "last_affected": "1.13.15"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ]
    },
    {
      "database_specific": {
        "last_known_affected_version_range": "\u003c= 1.16.5"
      },
      "package": {
        "ecosystem": "Maven",
        "name": "io.micrometer:micrometer-jetty11"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "1.16.0"
            },
            {
              "fixed": "1.16.6"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ]
    },
    {
      "database_specific": {
        "last_known_affected_version_range": "\u003c= 1.15.11"
      },
      "package": {
        "ecosystem": "Maven",
        "name": "io.micrometer:micrometer-jetty11"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "1.15.0"
            },
            {
              "fixed": "1.15.12"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ]
    },
    {
      "package": {
        "ecosystem": "Maven",
        "name": "io.micrometer:micrometer-jetty11"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "1.14.0"
            },
            {
              "last_affected": "1.14.14"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ]
    },
    {
      "package": {
        "ecosystem": "Maven",
        "name": "io.micrometer:micrometer-jetty11"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "0"
            },
            {
              "last_affected": "1.13.15"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ]
    }
  ],
  "aliases": [
    "CVE-2026-40984"
  ],
  "database_specific": {
    "cwe_ids": [
      "CWE-400",
      "CWE-770"
    ],
    "github_reviewed": true,
    "github_reviewed_at": "2026-08-06T19:10:08Z",
    "nvd_published_at": "2026-06-09T05:16:34Z",
    "severity": "HIGH"
  },
  "details": "In Micrometer, it is possible for a user to provide specially crafted HTTP requests that may cause a denial-of-service (DoS) condition.\n\nAffected versions:\nmicrometer-core 1.16.0 through 1.16.5; 1.15.0 through 1.15.11; 1.14.0 through 1.14.15; 1.13.0 through 1.13.18; 1.9.0 through 1.9.17.\nmicrometer-jetty11 1.16.0 through 1.16.5; 1.15.0 through 1.15.11; 1.14.0 through 1.14.15; 1.13.0 through 1.13.18.\nmicrometer-jetty12 1.16.0 through 1.16.5; 1.15.0 through 1.15.11; 1.14.0 through 1.14.15; 1.13.0 through 1.13.18.",
  "id": "GHSA-g3pr-3p32-fp23",
  "modified": "2026-08-13T15:34:06Z",
  "published": "2026-06-09T06:31:56Z",
  "references": [
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-40984"
    },
    {
      "type": "WEB",
      "url": "https://github.com/micrometer-metrics/micrometer/commit/36da131525228188a36779a28471a76c79213dd4"
    },
    {
      "type": "WEB",
      "url": "https://access.redhat.com/errata/RHSA-2026:36839"
    },
    {
      "type": "WEB",
      "url": "https://access.redhat.com/errata/RHSA-2026:37390"
    },
    {
      "type": "WEB",
      "url": "https://access.redhat.com/errata/RHSA-2026:41951"
    },
    {
      "type": "WEB",
      "url": "https://access.redhat.com/errata/RHSA-2026:50848"
    },
    {
      "type": "WEB",
      "url": "https://access.redhat.com/errata/RHSA-2026:50849"
    },
    {
      "type": "WEB",
      "url": "https://access.redhat.com/errata/RHSA-2026:54435"
    },
    {
      "type": "WEB",
      "url": "https://access.redhat.com/security/cve/CVE-2026-40984"
    },
    {
      "type": "WEB",
      "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2486716"
    },
    {
      "type": "PACKAGE",
      "url": "https://github.com/micrometer-metrics/micrometer"
    },
    {
      "type": "WEB",
      "url": "https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-40984.json"
    },
    {
      "type": "WEB",
      "url": "https://spring.io/security/cve-2026-40984"
    }
  ],
  "schema_version": "1.4.0",
  "severity": [
    {
      "score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
      "type": "CVSS_V3"
    }
  ],
  "summary": "Micrometer HTTP server instrumentations DoS"
}

Sightings

Author	Source	Type	Date	Other

Nomenclature

Seen: The vulnerability was mentioned, discussed, or observed by the user.
Confirmed: The vulnerability has been validated from an analyst's perspective.
Published Proof of Concept: A public proof of concept is available for this vulnerability.
Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
Not confirmed: The user expressed doubt about the validity of the vulnerability.
Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.

Detection rules are retrieved from Rulezet.

The MITRE ATT&CK techniques below are AI-generated suggestions, inferred from the description of the vulnerability by the CIRCL/vulnerability-attack-technique-classification-roberta-base model, served locally by ML-Gateway. They have not been verified by an analyst and are provided for guidance only.
The approach is described in our paper Mapping CVEs to MITRE ATT&CK Techniques: A Curated Gold-Set Classifier and the Limits of LLM-Assisted Label Expansion.

Action not permitted

CVE-2026-40984 (GCVE-0-2026-40984)

Solutions

Vulnerability from cleanstart

Vulnerability from cleanstart

Vulnerability from cleanstart

Vulnerability from cleanstart

Vulnerability from cleanstart

Vulnerability from cleanstart

Vulnerability from cleanstart

Tags

Sightings

Nomenclature