CVE-2026-59323: Micrometer Tracing Brave Bridge W3C Baggage propagation DoS vulnerability

Severity: medium (CVSS 5.3 v3.1)
Exploited in the wild: not listed in CISA KEV
EPSS: 0.4% probability of exploitation in the next 30 days
Public exploit or detection template: none known
Published: 2026-08-21 · updated 2026-10-16
Weakness: CWE-770

Description

An application using Micrometer Tracing with W3C baggage propagation in the Brave bridge is vulnerable to denial of service (DoS) due to unbounded object allocation when extracting incoming baggage headers. Micrometer Tracing 1.7.0 Micrometer Tracing 1.6.0 - 1.6.6 Micrometer Tracing 1.5.0 - 1.5.12 Micrometer Tracing 1.4.13 and earlier

Affected products

Spring Micrometer Tracing: from 1.6.0 through 1.6.6; from 1.5.0 through 1.5.12; through 1.4.13; 1.7.0

References

https://spring.io/security/cve-2026-59323

Get alerted when CVE-2026-59323 or the next vulnerability affects your stack