CVE-2026-59323 — Micrometer Tracing Brave Bridge W3C Baggage propagation DoS vulnerability

CVE-2026-59323

Micrometer Tracing Brave Bridge W3C Baggage propagation DoS vulnerability PUBLISHED

Description (CNA)

An application using Micrometer Tracing with W3C baggage propagation in the Brave bridge is vulnerable to denial of service (DoS) due to unbounded object allocation when extracting incoming baggage headers. Micrometer Tracing 1.7.0 Micrometer Tracing 1.6.0 - 1.6.6 Micrometer Tracing 1.5.0 - 1.5.12 Micrometer Tracing 1.4.13 and earlier

Affected (CNA)

Vendor / product	Versions
Spring / Micrometer Tracing	affected 1.7.0; affected 1.6.0 through 1.6.6; affected 1.5.0 through 1.5.12; affected 0 through 1.4.13

CWE

No CWE identifiers supplied.

References

https://spring.io/security/cve-2026-59323

ADP enrichment

CISA-ADP

No English description supplied.

No references supplied.