CVE-2026-59295

Summary

Micrometer-instrumented Apache HttpAsyncClient (4.x or 5.x) usage via MicrometerHttpClientInterceptor can leak memory unboundedly when asynchronous requests fail before receiving a response (e.g. connection resets or timeouts). Tracking state for these requests remains in memory indefinitely, and sustained failures lead to heap exhaustion and OutOfMemoryError crashes.

Affected Software

VendorProductVersion RangeStatus
VMware (Broadcom)io.micrometer:micrometer-core0 <= 1.9.18affected
VMware (Broadcom)io.micrometer:micrometer-core1.14.0 <= 1.14.16affected
VMware (Broadcom)io.micrometer:micrometer-core1.15.0 <= 1.15.12affected
VMware (Broadcom)io.micrometer:micrometer-core1.16.0 <= 1.16.6affected
VMware (Broadcom)io.micrometer:micrometer-core1.17.0affected
VMware (Broadcom)io.micrometer:micrometer-core1.9.19unaffected
VMware (Broadcom)io.micrometer:micrometer-core1.14.17unaffected
VMware (Broadcom)io.micrometer:micrometer-core1.15.13unaffected
VMware (Broadcom)io.micrometer:micrometer-core1.16.7unaffected
VMware (Broadcom)io.micrometer:micrometer-core1.16.6.1unaffected
VMware (Broadcom)io.micrometer:micrometer-core1.17.1unaffected
VMware (Broadcom)io.micrometer:micrometer-core1.17.0.1unaffected

Weaknesses

  • CWE-401: CWE-401: Missing Release of Memory after Effective Lifetime

Workarounds

Migrate to Apache HttpClient 5.6.x's native httpclient5-observation module, or use ObservationExecChainHandler when using HttpClient 5.x with Micrometer 1.12.0+.

ADP Enrichment

CISA ADP Vulnrichment

  • SSVC:
  • Exploitation: none
    • Automatable: no
    • Technical Impact: partial

References