Micrometer versions 1.15.0 through 1.15.11 and 1.16.0 through 1.16.5 contain a vulnerability (CVE-2026-40983) where specially crafted gRPC requests can cause uncontrolled resource consumption, leading to denial-of-service (DoS). This flaw allows remote unauthenticated attackers to disrupt system availability by exhausting CPU, memory, or other resources. The vulnerability is classified under CWE-400 and CWE-770, indicating allocation of resources without limits or throttling. The broad accessibility of gRPC endpoints in typical deployments increases the risk. Red Hat advisory confirms the issue and recommends network access restrictions and disabling gRPC if unnecessary. No official patch or fix is currently available, and remediation level is unknown.

The vulnerability enables remote unauthenticated attackers to cause a denial-of-service condition by exhausting system resources through specially crafted gRPC requests. This impacts the availability of affected systems running vulnerable Micrometer versions. There is no impact on confidentiality or integrity. The broad exposure of gRPC endpoints in typical deployments increases the risk of service disruption.

No official patch or fix is currently confirmed for this vulnerability. To mitigate the risk, restrict network access to Micrometer's gRPC endpoints to trusted clients only. Implement firewall rules to limit inbound connections to the specific ports used by gRPC. If gRPC functionality is not essential, consider disabling it entirely to eliminate the attack vector. Note that changes to network configurations or service settings may require service restarts, potentially impacting availability during transition.