Micrometer Tracing Brave Bridge W3C Baggage DoS Vulnerability (CVE-2026-59323)

Vulnerability Overview Vulnerability Name: Micrometer Tracing Brave Bridge W3C Baggage Propagation DoS Vulnerability Vulnerability Type: Denial of Service (DoS) Severity: Medium Publication Date: August 20, 2026 CVE ID: CVE-2026-59323 Scope of Impact Affected Products: Micrometer Tracing Affected Versions: - 1.7.0 – 1.7.0 - 1.6.0 – 1.6.6 - 1.5.0 – 1.5.12 - 1.4.13 and earlier Remediation Fixed Versions: - 1.7.0.1 (Enterprise Support Only) - 1.7.1 (OSS) - 1.6.6.1 (Enterprise Support Only) - 1.6.7 (OSS) - 1.5.13 (Enterprise Support Only) - 1.4.14 (Enterprise Support Only) Temporary Mitigation: - If an immediate upgrade is not possible, restrict or strip the header from untrusted sources (e.g., at the API gateway, ingress proxy, or load balancer) to enforce size limits and filter untrusted baggage fields. Additional Information Vulnerability Description: Applications using Micrometer Tracing with the W3C baggage propagation Brave bridge are susceptible to Denial of Service (DoS) attacks when extracting incoming headers due to unbounded object allocation. Vulnerability Preconditions: - The application uses a vulnerable version of . - W3C propagation is active (manually configured or activated by default, such as in Spring Boot 3.x+). - Baggage propagation is enabled (enabled by default in Spring Boot 3.x+ and configured with a baggage manager, such as ). - The application processes requests or messages from untrusted sources containing headers. - Network components (including the HTTP server receiving the requests) do not enforce header size limits or set limits high enough to cause issues. References NIST NVD CVSS Calculator History 2026-08-20: Initial vulnerability report published.

Goal Reached Thanks to every supporter — we hit 100%!

Micrometer Tracing Brave Bridge W3C Baggage DoS Vulnerability (CVE-2026-59323)