Copyright © 2012 Red Hat, Inc. All rights reserved. Moderate 2026-08-24T10:10:06 io.micrometer/micrometer-core: Micrometer Instrumentation for Apache HttpAsyncClient: Denial of Service via asynchronous request failures CWE-772

Micrometer-instrumented Apache HttpAsyncClient (4.x or 5.x) usage via MicrometerHttpClientInterceptor can leak memory unboundedly when asynchronous requests fail before receiving a response (e.g. connection resets or timeouts). Tracking state for these requests remains in memory indefinitely, and sustained failures lead to heap exhaustion and OutOfMemoryError crashes.

A flaw was found in Micrometer Instrumentation for Apache HttpAsyncClient. When asynchronous requests fail before receiving a response, such as due to connection resets or timeouts, the system can leak memory unboundedly. This continuous memory leak leads to heap exhaustion and OutOfMemoryError crashes, resulting in a Denial of Service (DoS) for the affected application.

This Moderate severity flaw impacts Red Hat products utilizing Micrometer-instrumented Apache HttpAsyncClient. The vulnerability can lead to a denial of service due to unbounded memory growth when asynchronous requests fail before a response is received. Exploitation requires specific network conditions or failures, making the attack complexity high. Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base, or stability. Exploit Intelligence Not affected exploit-intelligence/agent-client-rhel9 Red Hat AMQ Broker 7 Affected micrometer-core Red Hat build of Apache Camel 4 for Quarkus 3 Not affected micrometer-core Red Hat build of Apache Camel for Spring Boot 4 Not affected micrometer-core Red Hat build of Apicurio Registry 3 Not affected micrometer-core Red Hat build of Debezium 3 Not affected micrometer-core Red Hat Build of Keycloak Not affected keycloak/rhbk-openshift-rhel9 Red Hat Build of Keycloak Not affected keycloak/rhbk-rhel9-operator Red Hat Build of Keycloak Not affected micrometer-core Red Hat Build of Keycloak Not affected rhbk/keycloak-rhel9 Red Hat Build of Keycloak Not affected rhbk/keycloak-rhel9-operator Red Hat build of Quarkus Affected micrometer-core Red Hat Data Grid 8 Not affected micrometer-core Red Hat Fuse 7 Not affected micrometer-core Red Hat JBoss Enterprise Application Platform 8 Not affected micrometer-core Red Hat JBoss Enterprise Application Platform Expansion Pack Not affected micrometer-core Red Hat OpenShift AI (RHOAI) Not affected rhoai/odh-trustyai-service-rhel9 Red Hat OpenShift Dev Spaces Not affected devspaces/openvsx-rhel9 Red Hat OpenShift Dev Spaces Not affected devspaces/pluginregistry-rhel9 Red Hat OpenShift Dev Spaces Not affected devspaces/server-rhel9 Red Hat Satellite 6 Not affected candlepin https://www.cve.org/CVERecord?id=CVE-2026-59295 https://nvd.nist.gov/vuln/detail/CVE-2026-59295 https://github.com/spring-projects/security-advisories/security/advisories/GHSA-747c-jhq3-w433 https://spring.io/security/cve-2026-59295