Bug 2521797 (CVE-2026-59295)

Summary:	CVE-2026-59295 io.micrometer/micrometer-core: Micrometer Instrumentation for Apache HttpAsyncClient: Denial of Service via asynchronous request failures
Product:	[Other] Security Response	Reporter:	OSIDB Bzimport <bzimport>
Component:	vulnerability	Assignee:	Product Security DevOps Team <prodsec-dev>
Status:	NEW ---	QA Contact:
Severity:	medium	Docs Contact:
Priority:	medium
Version:	unspecified	CC:	anthomas, ant, anujha, aschwart, asoldano, aszczucz, ataylor, avibelli, bbaranow, bgeorges, bmaxwell, boliveir, bstansbe, ccranfor, cescoffi, cmah, dandread, dbruscin, dkreling, dlofthou, drichtar, ehelms, ehugonne, ewittman, fmariani, fmongiar, ggainey, gmalinko, gsmet, gtanzill, istudens, ivassile, iweiss, janstey, jbuscemi, jmartisk, jnethert, jpasqual, jpechane, juwatts, jwon, kaycoth, kvanderr, lthon, manderse, mcarlett, mdellweg, mhulan, mosmerov, mposolda, msvehla, nipatil, nmoumoul, nwallace, olubyans, osousa, pantinor, pberan, pcreech, pdelbell, pesilva, pgallagh, pjindal, pmackay, probinso, rchan, rguimara, rkubis, rmartinc, rruss, rstancel, rstepani, rsvoboda, sbiarozk, sdawley, smallamp, ssilvert, sthorger, tcunning, thjenkin, tmalecek, tqvarnst, vdosoudi, vmuzikar, yfang
Target Milestone:	---	Keywords:	Security
Target Release:	---
Hardware:	All
OS:	Linux
Whiteboard:
Fixed In Version:		Doc Type:	---
Doc Text:	A flaw was found in Micrometer Instrumentation for Apache HttpAsyncClient. When asynchronous requests fail before receiving a response, such as due to connection resets or timeouts, the system can leak memory unboundedly. This continuous memory leak leads to heap exhaustion and OutOfMemoryError crashes, resulting in a Denial of Service (DoS) for the affected application.	Story Points:	---
Clone Of:		Environment:
Last Closed:		Type:	---
Regression:	---	Mount Type:	---
Documentation:	---	CRM:
Verified Versions:		Category:	---
oVirt Team:	---	RHEL 7.3 requirements from Atomic Host:
Cloudforms Team:	---	Target Upstream Version:
Embargoed:

Description OSIDB Bzimport 2026-08-24 10:39:48 UTC

Micrometer-instrumented Apache HttpAsyncClient (4.x or 5.x) usage via MicrometerHttpClientInterceptor can leak memory unboundedly when asynchronous requests fail before receiving a response (e.g. connection resets or timeouts). Tracking state for these requests remains in memory indefinitely, and sustained failures lead to heap exhaustion and OutOfMemoryError crashes.

Comment 2 Jon Orris 2026-10-21 07:35:14 UTC

This issue has been addressed in the following products:

  Streams for Apache Kafka 3.2.2

Via RHSA-2026:86676 https://access.redhat.com/errata/RHSA-2026:86676