Micrometer HttpAsyncClient Memory Leak (CVE-2026-59295): Scope and Response

Tracking state retained after pre-response failures

CVE-2026-59295 affects Micrometer instrumentation of Apache HttpAsyncClient 4.x and 5.x. When an asynchronous outbound request fails before any response message arrives, MicrometerHttpClientInterceptor can leave tracking state behind. Repeated connection resets, timeouts, or socket failures produce an unbounded JVM heap leak and can end in OutOfMemoryError.

Affected combination

• An affected io.micrometer:micrometer-core version is deployed.
• Apache HttpAsyncClient 4.x or 5.x is instrumented with MicrometerHttpClientInterceptor.
• Outbound calls can fail before the response message, including hostile or unreliable endpoints.
• Retries or concurrency increase the number of failing requests.

Affected ranges include 1.17.0, 1.16.0 through 1.16.6, 1.15.0 through 1.15.12, 1.14.0 through 1.14.16, and 1.9.18 or earlier.

Fixes and alternatives

The advisory lists OSS fixes in 1.17.1 and 1.16.7. Other maintenance-line fixes are available through Enterprise Support as listed by Spring. For Apache HTTP Client 5.6 or later, the httpclient5-observation module supersedes the vulnerable instrumentation. With Apache HTTP Client 5.x and Micrometer 1.12 or later, migrate from MicrometerHttpClientInterceptor to ObservationExecChainHandler.

Validation

1. Confirm the resolved micrometer-core version in the deployed artifact.
2. Locate the HttpAsyncClient instrumentation configuration.
3. Test connection resets, timeouts, and socket failures.
4. Verify tracking state and heap return to a stable baseline.
5. Confirm metrics, tags, dashboards, and alerts after upgrading or migrating.
6. Monitor heap, old-generation growth, GC pauses, OOM events, and restarts.

Verification time

The Spring advisory was rechecked for the August 25, 2026 14:00 KST cycle.