CVE-2026-40984 is an uncontrolled resource consumption vulnerability (CWE-400, CWE-770) in Micrometer, allowing remote attackers to cause denial-of-service by sending specially crafted HTTP requests. The flaw affects micrometer-core versions 1.9.0 through 1.9.17, 1.13.0 through 1.13.18, 1.14.0 through 1.14.15, 1.15.0 through 1.15.11, and 1.16.0 through 1.16.5, as well as corresponding versions of micrometer-jetty11 and micrometer-jetty12. Exploitation requires HTTP server instrumentation configured to record metrics. The vulnerability results in resource exhaustion impacting availability. Red Hat's advisory confirms the impact and provides guidance but does not specify a fixed version or patch availability.

The vulnerability allows remote, unauthenticated attackers to cause a denial-of-service condition by exhausting system resources through specially crafted HTTP requests. This disrupts the availability of affected services using Micrometer instrumentation. There is no impact on confidentiality or integrity. No known exploits in the wild have been reported at this time.

Red Hat's advisory does not indicate that a fix is currently available or that the issue is mitigated. Therefore, patch status is not yet confirmed—check the vendor advisory for current remediation guidance. Users should monitor Red Hat's security updates and apply patches once released. In the meantime, consider disabling or limiting HTTP server instrumentation metrics if feasible to reduce exposure.