{"action":"Upgrade io.micrometer:micrometer-jetty12 to 1.15.12 (1.15.x) or 1.16.6 (1.16.x) or later.","affected":[{"fixed":"1.16.6","introduced":"1.16.0"},{"fixed":"1.15.12","introduced":"1.15.0"},{"introduced":"1.14.0","last_affected":"1.14.14"},{"introduced":"0","last_affected":"1.13.15"}],"component":"io.micrometer:micrometer-jetty12","cve_ids":["CVE-2026-40984"],"ecosystem":"Maven","epss":0.00792,"exploited":false,"fixed_versions":["1.16.6","1.15.12"],"ghsa_id":"GHSA-g3pr-3p32-fp23","id":"tcs_01M5N8X6HQNNZM078QM89SQG7D","modified_at":"2026-09-11T15:45:08.795437706Z","published_at":"2026-06-09T06:31:56Z","references":["https://osv.dev/vulnerability/GHSA-g3pr-3p32-fp23","https://nvd.nist.gov/vuln/detail/CVE-2026-40984","https://github.com/micrometer-metrics/micrometer/commit/36da131525228188a36779a28471a76c79213dd4","https://access.redhat.com/errata/RHSA-2026:36839","https://access.redhat.com/errata/RHSA-2026:37390","https://access.redhat.com/errata/RHSA-2026:41951","https://access.redhat.com/errata/RHSA-2026:50848","https://access.redhat.com/errata/RHSA-2026:50849","https://access.redhat.com/errata/RHSA-2026:54435","https://access.redhat.com/errata/RHSA-2026:62260","https://access.redhat.com/errata/RHSA-2026:66488","https://access.redhat.com/errata/RHSA-2026:66545","https://access.redhat.com/security/cve/CVE-2026-40984","https://bugzilla.redhat.com/show_bug.cgi?id=2486716","https://github.com/micrometer-metrics/micrometer","https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-40984.json","https://spring.io/security/cve-2026-40984"],"severity":{"label":"high","score":7.5},"sources":[{"source":"osv","source_id":"GHSA-g3pr-3p32-fp23#Maven/io.micrometer:micrometer-jetty12","url":"https://osv.dev/vulnerability/GHSA-g3pr-3p32-fp23"}],"summary":"Micrometer HTTP server instrumentations DoS"}