CVE-2026-59295

Awaiting Analysis Awaiting Analysis - Queue

Memory Leak in Apache HttpAsyncClient via Micrometer Interceptor

Publication date: 2026-08-24

Last updated on: 2026-08-27

Assigner: VMware

Description

It is possible for outbound HTTP requests using a Micrometer-instrumented client to cause a denial-of-service (DoS) condition due to an unbounded memory leak. Micrometer 1.17.0 Micrometer 1.16.0 - 1.16.6 Micrometer 1.15.0 - 1.15.12 Micrometer 1.14.0 - 1.14.16 Micrometer 1.9.18 and earlier

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-08-24

Last Modified

2026-08-27

Generated

2026-09-13

AI Q&A

2026-08-24

EPSS Evaluated

2026-09-12

NVD

CVE-2026-59295

EUVD

EUVD-2026-64774

Affected Vendors & Products

Vendor	Product	Version / Range
micrometer	micrometer	From 1.14.0 (inc) to 1.18.0 (exc)
micrometer	micrometer	to 1.10.0 (exc)
apache	httpasyncclient	4.x
apache	httpasyncclient	5.x

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-401	The product does not sufficiently track and release allocated memory after it has been used, making the memory unavailable for reallocation and reuse.

Attack-Flow Graph

Executive Summary

This is a medium-severity denial-of-service (DoS) vulnerability in Micrometer-instrumented Apache HttpAsyncClient versions. When HTTP requests fail before receiving a response due to connection issues or timeouts, the tracking state remains in memory indefinitely. This causes unbounded memory leaks in the JVM heap, eventually leading to application crashes from OutOfMemoryError.

Detection Guidance

Monitor JVM heap usage for unbounded growth during HTTP request failures. Check for OutOfMemoryError crashes in application logs. Use tools like jcmd, jstat, or VisualVM to track heap memory and identify leaks originating from Micrometer-instrumented HttpAsyncClient requests.

Impact Analysis

The vulnerability can cause your application to crash due to memory exhaustion. Sustained failures in HTTP requests will fill up heap memory, triggering OutOfMemoryError and making the application unresponsive or unavailable.

Compliance Impact

This vulnerability could indirectly impact compliance with GDPR or HIPAA by causing application crashes due to memory exhaustion. OutOfMemoryError crashes may lead to service disruptions, potentially affecting data processing or availability requirements under these regulations. However, the core issue is a DoS vulnerability rather than a direct data exposure risk.

Mitigation Strategies

Upgrade Micrometer to fixed versions (1.17.1, 1.16.7, 1.15.13, 1.14.17, or 1.9.19).
For Apache HTTP Client 5.x, switch to httpclient5-observation module or use ObservationExecChainHandler instead of MicrometerHttpClientInterceptor.

Hi! I’m here to help you understand CVE-2026-59295. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70