CVE-2026-40984

Highest-risk unexploited with PoCs

Exploit code exists, no confirmed in-the-wild activity, ranked by EPSS

Actively Exploited

Confirmed exploited in the wild, sorted by most recently updated

CVSS 7.5EPSS 1%

Published 2026-06-09Updated 2026-06-09

Vulnerability details

In Micrometer, it is possible for a user to provide specially crafted HTTP requests that may cause a denial-of-service (DoS) condition. Affected versions: micrometer-core 1.16.0 through 1.16.5; 1.15.0 through 1.15.11; 1.14.0 through 1.14.15; 1.13.0 through 1.13.18; 1.9.0 through 1.9.17. micrometer-jetty11 1.16.0 through 1.16.5; 1.15.0 through 1.15.11; 1.14.0 through 1.14.15; 1.13.0 through 1.13.18. micrometer-jetty12 1.16.0 through 1.16.5; 1.15.0 through 1.15.11; 1.14.0 through 1.14.15; 1.13.0 through 1.13.18.

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

CNAvmware

EPSS score history

Sources

2 links

PoC links are not available for guest users. Login to view them.

CVE Organization RedHat Vuln DB

Profile

CVSS

7.5

EPSS

Published

2026-06-09

Updated

2026-06-09

CNA

vmware

Vendors

Spring

1 product

CPEs

cpe:/a:redhat:amq_broker:7

cpe:/a:redhat:amq_clients:2023

cpe:/a:redhat:apache_camel_hawtio:4

cpe:/a:redhat:camel_quarkus:3

cpe:/a:redhat:camel_spring_boot:4

cpe:/a:redhat:apicurio_registry:3

cpe:/a:redhat:debezium:3

cpe:/a:redhat:build_keycloak:

cpe:/a:redhat:optaplanner:::el6

cpe:/a:redhat:quarkus:3

cpe:/a:redhat:jboss_data_grid:8

cpe:/a:redhat:jboss_fuse:7

cpe:/a:redhat:jbosseapxp

cpe:/a:redhat:jboss_enterprise_bpms_platform:7

cpe:/a:redhat:amq_streams:2

cpe:/a:redhat:amq_streams:3

cpe:/a:redhat:openshift_ai

cpe:/a:redhat:openshift_devspaces:3

cpe:/a:redhat:apache_camel_quarkus:3.33

cpe:/a:redhat:apache_camel_spring_boot:4.18

cpe:/a:redhat:build_keycloak:26.6::el9

cpe:/a:redhat:amq_streams:3.2::el9

cpe:/a:redhat:openshift_devspaces:3.30::el9

cpe:/a:redhat:amq_broker:7.13

cpe:/a:redhat:amq_broker:7.14

Vulnerability dashboard

Highest-risk unexploited with PoCs

Actively Exploited

Recently Updated