An application using Micrometer Tracing with W3C baggage propagation in the Brave bridge can suffer a denial of service when incoming baggage headers contain an excessive number of key-value pairs. The vulnerable library parses these headers without enforcing limits, allocating an unconstrained number of BaggageField objects. This results in high garbage collection pressure, increased CPU usage, and can trigger OutOfMemoryErrors that crash the application.

The vulnerability affects applications that use a vulnerable release of io.micrometer:micrometer-tracing-bridge-brave, have W3C propagation enabled (either manually or by default in Spring Boot 3.x+), enable baggage propagation (default in Spring Boot 3.x+), and process requests or messages from untrusted sources containing baggage headers. Any deployment of VMware:Spring or Spring Boot 3.x+ that includes this trunk is potentially impacted if the HTTP server does not limit header size or the limit is set too high.

The CVSS score of 5.3 indicates moderate severity, and the EPSS score is currently unavailable. This vulnerability is not listed in the CISA KEV catalog. Exploitation requires an attacker to send HTTP requests or messages with oversized baggage headers to an application that has permissive header size limits. Because the parsing code does not impose bounds, the attack is straightforward for someone with network access to the service and can lead to resource exhaustion and service disruption.