Technical impact
Micrometer instrumenting Apache HttpAsyncClient can leak memory when asynchronous requests fail before a response is received, such as on connection resets or timeouts. The internal tracking of these failed requests is never cleared, allowing successive failures to consume heap space until the application runs out of memory and crashes. This flaw is a classic resource mismanagement issue (CWE-772) that results in a denial of service rather than direct code execution.
Affected Systems
The vulnerability affects the Spring:Micrometer instrumentation library used in applications that employ Apache HttpAsyncClient 4.x or 5.x. Affected Micrometer Core versions include 1.17.0, 1.16.0 through 1.16.6, 1.15.0 through 1.15.12, 1.14.0 through 1.14.16, and any releases 1.9.18 or earlier. No specific patched versions are listed; the issue occurs in any Micrometer build that contains the MicrometerHttpClientInterceptor integration for these client libraries.
Risk and Exploitability
The CVSS score of 5.9 indicates moderate severity. The EPSS score is below 1%, and the vulnerability is not listed in the CISA KEV catalog. Based on the description, it is inferred that an attacker can exploit the problem by inducing repeated asynchronous request failures through normal traffic or crafted requests, thereby draining memory until the service crashes. Based on the description, it is inferred that the attack vector is likely remote, as any network interaction that triggers the client can be used to generate failures.
