CVE-2026-59323 Security Details

CVE ID

CVE-2026-59323

CWE

CWE-770

CVE Description

An application using Micrometer Tracing with W3C baggage propagation in the Brave bridge is vulnerable to denial of service (DoS) due to unbounded object allocation when extracting incoming baggage headers. Micrometer Tracing 1.7.0 Micrometer Tracing 1.6.0 - 1.6.6 Micrometer Tracing 1.5.0 - 1.5.12 Micrometer Tracing 1.4.13 and earlier

Published

Aug 21, 2026

CVSS Score & Severity

6.9Medium

CVSS Vector

CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N

EPSS Score

0.402%

Malware

malware

KEV Status

Not in KEV Catalog: No known exploits

Vulnerable Methods

io/micrometer/tracing/brave/bridge/W3CBaggagePropagator.addBaggageToContext(Ljava/lang/String;)Ljava/util/List;

JVMVulnerable params: 0

Affected Ecosystems

affected

Source

National Vulnerability Database

References

spring.ioPROJECT