The vulnerability identified as CVE-2026-40983 in the Micrometer library (versions 1.15.0 through 1.15.11 and 1.16.0 through 1.16.5) allows an attacker to trigger uncontrolled resource consumption via specially crafted gRPC requests, leading to a denial-of-service condition. This is categorized under CWE-400 (Uncontrolled Resource Consumption) and CWE-770. The CVSS v3.1 score is 7.5 (high severity) with network attack vector, low attack complexity, no privileges or user interaction required, and impact limited to availability. Red Hat has published an advisory and issued an update for their build of Apache Camel including a fix for this vulnerability, indicating that a patch is available through their update channels.

Successful exploitation of this vulnerability can cause a denial-of-service condition by exhausting system resources when processing malicious gRPC requests. This impacts the availability of applications using the affected Micrometer versions. There is no impact on confidentiality or integrity according to the CVSS vector and vendor information.

Red Hat has released an important security update that addresses this vulnerability in their build of Apache Camel for Quarkus (RHBQ 3.33.2.SP2). Users of affected Micrometer versions should apply this update or equivalent patches from their vendor to remediate the issue. Since no direct patch from the original Micrometer project is explicitly stated, users should monitor vendor advisories for official fixes. Until patched, consider restricting or validating gRPC request inputs to mitigate potential resource exhaustion.