CVE-2026-40984 is a CWE-400 (Uncontrolled Resource Consumption) vulnerability in the Micrometer library used in Spring projects. It allows an attacker to send specially crafted HTTP requests that can cause a denial-of-service condition by exhausting resources. The affected components include micrometer-core, micrometer-jetty11, and micrometer-jetty12 across multiple version ranges. The vulnerability has a CVSS v3.1 score of 7.5 (high severity) with network attack vector, low attack complexity, no privileges required, no user interaction, and impacts availability only. Red Hat has acknowledged the vulnerability and issued an advisory but has not explicitly stated a fixed version or patch availability in the provided content.

Successful exploitation of this vulnerability can lead to denial-of-service conditions, impacting the availability of applications using the affected Micrometer components. There is no impact on confidentiality or integrity reported. The vulnerability can be triggered remotely without authentication or user interaction.

Red Hat has published an advisory regarding this vulnerability. However, the provided information does not explicitly confirm the availability of a patch or official fix. Users should consult the Red Hat advisory at https://access.redhat.com/security/cve/CVE-2026-40984 for the latest remediation guidance. Until a fix is applied, consider limiting exposure to untrusted HTTP requests targeting Micrometer endpoints. Patch status is not yet confirmed — check the vendor advisory for current remediation guidance.