Micrometer instrumenting Apache HttpAsyncClient can leak memory when asynchronous requests fail before receiving a response, such as on connection resets or timeouts. The internal tracking of these failed requests is never cleared, allowing successive failures to consume heap space until the application runs out of memory and crashes. This flaw is a classic resource mismanagement issue (CWE-401) and results in a denial of service rather than direct code execution.

The vulnerability affects VMware (Broadcom) Micrometer Core, the Micrometer instrumentation library. It is relevant to applications that use Micrometer with Apache HttpAsyncClient 4.x or 5.x. No specific patched versions are listed in the data; the affected constructs are the MicrometerHttpClientInterceptor integration used in both client versions.

The CVSS score of 5.9 indicates moderate severity. The EPSS score is not available, and the vulnerability is not in the CISA KEV catalog. An attacker can exploit the problem by inducing repeated asynchronous request failures through normal traffic or crafted requests, thereby draining memory until the service crashes. The attack vector is likely remote, as any network interaction that triggers the client can be used to generate failures.