Micrometer gRPC Server Instrumentation Denial-of-Service Vulnerability

A denial-of-service vulnerability has been identified in Micrometer versions 1.16.0 through 1.16.5 and 1.15.0 through 1.15.11. The issue arises when a user sends specially crafted gRPC requests that can disrupt service. An application is vulnerable if it uses affected Micrometer versions, has an ObservationRegistry that records observations, and is configured to output metrics from observations via the DefaultMeterObservationHandler or a custom observation handler. Additionally, the application must use the ObservationGrpcServerInterceptor to instrument its gRPC server.

Impact

Exploitation of this vulnerability can lead to a denial-of-service condition, causing the application to become unresponsive or unavailable.

Remediation

Users of Micrometer 1.16.x should upgrade to 1.16.6, and users of Micrometer 1.15.x should upgrade to 1.15.12.