The vulnerability CVE-2026-40984 in Spring Micrometer involves uncontrolled resource consumption (CWE-400) triggered by specially crafted HTTP requests. Affected versions include micrometer-core 1.9.0 through 1.16.5 and micrometer-jetty11/jetty12 in the same version ranges. The flaw can lead to a denial-of-service condition by exhausting resources. The CVSS 3.1 base score is 7.5 (high severity) with network attack vector, low attack complexity, no privileges required, no user interaction, and impact limited to availability. There is currently no vendor-provided patch or official remediation guidance.

Successful exploitation of this vulnerability can cause a denial-of-service condition, impacting the availability of applications using the affected Micrometer versions. There is no impact on confidentiality or integrity reported. No known exploits are currently in the wild.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is released, users should consider mitigating exposure by limiting access to affected services or applying rate limiting to reduce the risk of resource exhaustion. Monitor vendor channels for updates and apply patches promptly once available.