CVE-2026-59295— Micrometer Instrumentation of Apache HttpAsyncClient Denial of Service Vulnerability
Quick assessment
Affected
VMware (Broadcom) io.micrometer:micrometer-core
Exploitation
No confirmed in-the-wild exploitation; assess based on exposure
Recommended action
Check the vendor advisory and references for a fixed version. If immediate upgrade is impossible, restrict exposure and increase monitoring.
当使用 MicrometerHttpClientInterceptor 通过 Micrometer 监控 Apache HttpAsyncClient（4.x 或 5.x 版本）时，如果异步请求在接收到响应之前失败（例如连接重置或超时），则可能导致内存无限泄漏。这些失败请求的状态信息将一直保留在内存中，持续发生的失败会导致堆内存耗尽，并最终引发 OutOfMemoryError（内存溢出）崩溃。
Get alerts for future matching vulnerabilities
Log in to subscribe
I. Basic Information for CVE-2026-59295
Vulnerability Information
Have questions about the vulnerability? See if Shenlong's analysis helps!
View Shenlong Deep Dive ↗
Although we use advanced large model technology, its output may still contain inaccurate or outdated information.Shenlong tries to ensure data accuracy, but please verify and judge based on the actual situation.
Vulnerability Title
Micrometer Instrumentation of Apache HttpAsyncClient Denial of Service Vulnerability
Source: CVE Program / CVE List V5
Vulnerability Description
Micrometer-instrumented Apache HttpAsyncClient (4.x or 5.x) usage via MicrometerHttpClientInterceptor can leak memory unboundedly when asynchronous requests fail before receiving a response (e.g. connection resets or timeouts). Tracking state for these requests remains in memory indefinitely, and sustained failures lead to heap exhaustion and OutOfMemoryError crashes.
Source: CVE Program / CVE List V5
CVSS Information
CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H
Source: CVE Program / CVE List V5
Vulnerability Type
在移除最后引用时对内存的释放不恰当(内存泄露)
Source: CVE Program / CVE List V5
Affected Products
| Vendor | Product | Affected Versions | CPE | Subscribe |
|---|---|---|---|---|
| VMware (Broadcom) | io.micrometer:micrometer-core | 0 ~ 1.9.18 | - |
|
II. Public POCs for CVE-2026-59295
| # | POC Description | Source Link | Shenlong Link |
|---|
AI-Generated POC
Premium
No public POC found.
Login to generate AI POCIII. Intelligence Information for CVE-2026-59295
请登录查看更多情报信息。
Vendor Advisories for CVE-2026-59295 (2)
IV. Related Vulnerabilities
Same weakness: CWE-401
-
CVE-2026-12999
Infineon Airoc Wi-Fi driver leaks TX buffers on send failure -
CVE-2026-76235
Cockpit-ws: cockpit: cockpit-ws: unauthenticated remote memo -
CVE-2026-52734
ZEBRA: Unbounded memory leak in mempool download pipeline vi -
CVE-2026-73565
@hono/node-server: Unauthenticated memory-leak DoS via abort -
CVE-2026-19382
Almico Speedfan MSR Index speedfan.sys KiSystemCall64 memory
V. Comments for CVE-2026-59295
No comments yet