CVE-2026-59295
Received Received - Intake

Memory Leak in Apache HttpAsyncClient via Micrometer Interceptor

Publication date: 2026-08-24

Last updated on: 2026-08-24

Assigner: VMware

Description
Micrometer-instrumented Apache HttpAsyncClient (4.x or 5.x) usage via MicrometerHttpClientInterceptor can leak memory unboundedly when asynchronous requests fail before receiving a response (e.g. connection resets or timeouts). Tracking state for these requests remains in memory indefinitely, and sustained failures lead to heap exhaustion and OutOfMemoryError crashes.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-08-24
Last Modified
2026-08-24
Generated
2026-08-24
AI Q&A
2026-08-24
EPSS Evaluated
N/A
NVD
CVE-2026-59295
EUVD
EUVD-2026-64774

Affected Vendors & Products

Showing 4 associated CPEs
Vendor Product Version / Range
micrometer micrometer From 1.14.0 (inc) to 1.18.0 (exc)
micrometer micrometer to 1.10.0 (exc)
apache httpasyncclient 4.x
apache httpasyncclient 5.x

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-401 The product does not sufficiently track and release allocated memory after it has been used, making the memory unavailable for reallocation and reuse.

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

This is a medium-severity denial-of-service (DoS) vulnerability in Micrometer-instrumented Apache HttpAsyncClient versions. When HTTP requests fail before receiving a response due to connection issues or timeouts, the tracking state remains in memory indefinitely. This causes unbounded memory leaks in the JVM heap, eventually leading to application crashes from OutOfMemoryError.

Detection Guidance

Monitor JVM heap usage for unbounded growth during HTTP request failures. Check for OutOfMemoryError crashes in application logs. Use tools like jcmd, jstat, or VisualVM to track heap memory and identify leaks originating from Micrometer-instrumented HttpAsyncClient requests.

Impact Analysis

The vulnerability can cause your application to crash due to memory exhaustion. Sustained failures in HTTP requests will fill up heap memory, triggering OutOfMemoryError and making the application unresponsive or unavailable.

Compliance Impact

This vulnerability could indirectly impact compliance with GDPR or HIPAA by causing application crashes due to memory exhaustion. OutOfMemoryError crashes may lead to service disruptions, potentially affecting data processing or availability requirements under these regulations. However, the core issue is a DoS vulnerability rather than a direct data exposure risk.

Mitigation Strategies
  • Upgrade Micrometer to fixed versions (1.17.1, 1.16.7, 1.15.13, 1.14.17, or 1.9.19).
  • For Apache HTTP Client 5.x, switch to httpclient5-observation module or use ObservationExecChainHandler instead of MicrometerHttpClientInterceptor.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-59295. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart