CVE-2026-59295: CWE-401 Missing Release of Memory after Effective Lifetime in Spring Micrometer

CVE-2026-59295 describes a memory leak vulnerability in Spring Micrometer's HTTP client instrumentation. Specifically, outbound HTTP requests made using a Micrometer-instrumented client can lead to unbounded memory consumption, resulting in a denial-of-service (DoS) condition. The root cause is a failure to release memory after its effective lifetime, categorized as CWE-401. Affected versions include Micrometer 1.17.0, all versions from 1.14.0 to 1.16.6, and all versions up to 1.9.18. The CVSS v3.1 score is 5.9 (medium severity) with vector AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H, indicating network attack vector, high attack complexity, no privileges or user interaction required, no confidentiality or integrity impact, but high availability impact. There is no information on available patches or vendor advisories in the provided data.

The vulnerability can cause a denial-of-service condition by exhausting memory resources due to an unbounded memory leak when making outbound HTTP requests with a Micrometer-instrumented client. This impacts availability but does not affect confidentiality or integrity. No known exploits are reported in the wild.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. No official fix or workaround information is provided in the available data. Users should monitor vendor communications for patches or updates addressing this memory leak.