Input validation error in Micrometer - CVE-2026-40983

Vulnerability identifier: #VU146375

CSH Severity: Medium

CVSS v4: 8.7 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

CVE-ID: CVE-2026-40983

CWE-ID: CWE-20

Exploitation vector: Remote access

Exploit availability: No public exploit available

The vulnerability allows a remote attacker to cause a denial of service.

The vulnerability exists due to improper input validation in ObservationGrpcServerInterceptor when handling specially crafted gRPC requests. A remote attacker can send a specially crafted gRPC request to cause a denial of service.

The issue is exposed only when observations are recorded and metrics are output through DefaultMeterObservationHandler or a similarly behaving custom ObservationHandler.

Micrometer
Crowd Data Center
Bitbucket Data Center
Confluence Data Center
Jira Software Data Center
Jira Service Management Data Center
Bamboo Data Center
Red Hat build of Quarkus
Red Hat Camel for Spring Boot
JBoss Data Grid

Install security update from vendor's website.

Micrometer - addressed in versions 1.15.12, 1.16.6
Crowd Data Center - update to 7.2.2
Bitbucket Data Center - update to 10.2.5
Confluence Data Center - update to 10.2.14
Jira Software Data Center - update to 11.3.8
Jira Service Management Data Center - update to 11.3.8
Bamboo Data Center - update to 12.1.10
Red Hat build of Quarkus - update to 3.33.2.SP2
Red Hat Camel for Spring Boot - update to 4.18
JBoss Data Grid - update to 8.6.2

• https://spring.io/security/cve-2026-40983

• Multiple vulnerabilities in Micrometer
• Multiple vulnerabilities in Red Hat build of Quarkus 3.33.2
• Multiple vulnerabilities in Red Hat Camel for Spring Boot 4
• Multiple vulnerabilities in JBoss Data Grid 8.6
• Multiple vulnerabilities in Bamboo Data Center
• Input validation error in Bitbucket Data Center
• Multiple vulnerabilities in Confluence Data Center
• Multiple vulnerabilities in Crowd Data Center
• Multiple vulnerabilities in Jira Service Management Data Center
• Multiple vulnerabilities in Jira Software Data Center