An application that uses Micrometer Tracing with W3C baggage propagation in the Brave bridge is vulnerable to denial of service because unbounded object allocation occurs when extracting incoming baggage headers. The library creates a new BaggageField object for each header entry without imposing limits, allowing a malicious payload with many key‑value pairs to exhaust memory and crash the application. This weakness is a classic resource exhaustion flaw identified by CWE‑770.

The vulnerability applies to applications using Spring's Micrometer Tracing library, including the vulnerable io.micrometer:micrometer-tracing-bridge-brave module. The issue exists in Micrometer Tracing releases 1.7.0, 1.6.0‑1.6.6, 1.5.0‑1.5.12, and 1.4.13 and earlier. If W3C baggage propagation is enabled (by default or configured) and the application accepts unknown baggage header values, untrusted traffic that sends excessive baggage entries can cause a denial of service. Deployment environments that forward requests from untrusted sources without enforcing HTTP header size limits are at risk.

The CVSS score of 5.3 indicates moderate severity. The EPSS score of 0.00372 indicates a very low likelihood of exploitation, and the vulnerability is not listed in the CISA KEV catalog. Exploitation requires an attacker with network access to the target to send HTTP requests containing oversized baggage headers. Because the parsing code imposes no bounds on the number or size of baggage entries, an attacker can readily induce resource exhaustion and service disruption.