CVE-2026-59323

{"id": "CVE-2026-59323", "cveTags": [], "metrics": {"ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2026-59323", "role": "CISA Coordinator", "options": [{"exploitation": "none"}, {"automatable": "yes"}, {"technicalImpact": "partial"}], "version": "2.0.3", "timestamp": "2026-08-21T12:03:29.254669Z"}}], "cvssMetricV31": [{"type": "Secondary", "source": "security@vmware.com", "cvssData": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 5.3, "attackVector": "NETWORK", "baseSeverity": "MEDIUM", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L", "integrityImpact": "NONE", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "LOW", "privilegesRequired": "NONE", "confidentialityImpact": "NONE"}, "impactScore": 1.4, "exploitabilityScore": 3.9}]}, "affected": [{"source": "security@vmware.com", "affectedData": [{"vendor": "Spring", "product": "Micrometer Tracing", "versions": [{"status": "affected", "version": "1.7.0", "versionType": "custom"}, {"status": "affected", "version": "1.6.0", "versionType": "custom", "lessThanOrEqual": "1.6.6"}, {"status": "affected", "version": "1.5.0", "versionType": "custom", "lessThanOrEqual": "1.5.12"}, {"status": "affected", "version": "0", "versionType": "custom", "lessThanOrEqual": "1.4.13"}], "defaultStatus": "unaffected"}]}], "published": "2026-08-21T10:16:38.910", "references": [{"url": "https://spring.io/security/cve-2026-59323", "source": "security@vmware.com"}], "vulnStatus": "Awaiting Analysis", "weaknesses": [{"type": "Secondary", "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "description": [{"lang": "en", "value": "CWE-770"}]}], "descriptions": [{"lang": "en", "value": "An application using Micrometer Tracing with W3C baggage propagation in the Brave bridge is vulnerable to denial of service (DoS) due to unbounded object allocation when extracting incoming baggage headers.\nMicrometer Tracing 1.7.0\nMicrometer Tracing 1.6.0 - 1.6.6\nMicrometer Tracing 1.5.0 - 1.5.12\nMicrometer Tracing 1.4.13 and earlier"}], "lastModified": "2026-08-28T18:47:30.163", "sourceIdentifier": "security@vmware.com"}