Vulnerability	Vulnerable Version
H Missing Release of Memory after Effective Lifetime Affected versions of this package are vulnerable to Missing Release of Memory after Effective Lifetime via the `MicrometerHttpClientInterceptor`. An attacker can cause unbounded memory consumption by repeatedly triggering asynchronous request failures before receiving a response, such as through connection resets or timeouts. This can ultimately lead to heap exhaustion and application crashes. How to fix Missing Release of Memory after Effective Lifetime? Upgrade `io.micrometer:micrometer-core` to version 1.16.7, 1.17.1 or higher.	[,1.16.7)[1.17.0.1,1.17.1)
H CRLF Injection Affected versions of this package are vulnerable to CRLF Injection through `DatadogStatsdLineBuilder`, `EtsyStatsdLineBuilder`, and the `Printer` in `LoggingMeterRegistry`. An attacker can spoof metrics or log entries by supplying meter names, tag keys, or tag values containing `\n` or `\r`, causing the generated StatsD or log output to break into additional lines. Notes Additional fixes are available for earlier versions under Enterprise Support (see the Spring Security Advisory for additional details) How to fix CRLF Injection? Upgrade `io.micrometer:micrometer-core` to version 1.16.7, 1.17.1 or higher.	[,1.16.7)[1.17.0,1.17.1)

Missing Release of Memory after Effective Lifetime

Affected versions of this package are vulnerable to Missing Release of Memory after Effective Lifetime via the MicrometerHttpClientInterceptor. An attacker can cause unbounded memory consumption by repeatedly triggering asynchronous request failures before receiving a response, such as through connection resets or timeouts. This can ultimately lead to heap exhaustion and application crashes.

How to fix Missing Release of Memory after Effective Lifetime?

Upgrade io.micrometer:micrometer-core to version 1.16.7, 1.17.1 or higher.

[,1.16.7)[1.17.0.1,1.17.1)

CRLF Injection

Affected versions of this package are vulnerable to CRLF Injection through DatadogStatsdLineBuilder, EtsyStatsdLineBuilder, and the Printer in LoggingMeterRegistry. An attacker can spoof metrics or log entries by supplying meter names, tag keys, or tag values containing \n or \r, causing the generated StatsD or log output to break into additional lines.

Notes

Additional fixes are available for earlier versions under Enterprise Support (see the Spring Security Advisory for additional details)

How to fix CRLF Injection?

Upgrade io.micrometer:micrometer-core to version 1.16.7, 1.17.1 or higher.

[,1.16.7)[1.17.0,1.17.1)

Go back to all versions of this package