Description

Micrometer-instrumented Apache HttpAsyncClient (4.x or 5.x) usage via MicrometerHttpClientInterceptor can leak memory unboundedly when asynchronous requests fail before receiving a response (e.g. connection resets or timeouts). Tracking state for these requests remains in memory indefinitely, and sustained failures lead to heap exhaustion and OutOfMemoryError crashes.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "5.9",
  "pubDate": "2026-08-24T11:16:39.780Z",
  "pubdate": "2026-08-24T11:16:39.780Z",
  "executiveSummary": "A memory leak vulnerability exists in Micrometer-instrumented Apache HttpAsyncClient (4.x or 5.x) usage via the MicrometerHttpClientInterceptor component. The vulnerability arises when asynchronous HTTP requests fail prior to receiving a response, such as during connection resets or network timeouts.\nUnder these failure conditions, internal state tracking mechanisms fail to release the associated request references, retaining them in memory indefinitely. Sustained volumes of failed asynchronous requests lead to unbounded memory consumption, culminating in heap exhaustion and fatal OutOfMemoryError crashes.\nThis issue impacts systems utilizing Micrometer for HTTP client instrumentation with Apache HttpAsyncClient across version ranges 4.x and 5.x. The risk implication is a high-severity denial of service (DoS) vector. An attacker or unstable network conditions can trigger the vulnerability by causing connection failures or timeouts.\nNo special authentication or high-level privileges are required to induce the failure states, as standard network disruptions or client-facing triggers can initiate the memory accumulation. Remediation requires updating or configuring the affected instrumentation interceptor to properly clean up request state upon failure.",
  "technicalDetails": "The vulnerability resides within the request lifecycle management implemented by the MicrometerHttpClientInterceptor when instrumenting Apache HttpAsyncClient (4.x or 5.x). The vulnerable component initializes internal metrics tracking and state retention structures at the initiation of an asynchronous HTTP request.\nThe root cause of the memory leak is improper exception and error handling during the asynchronous execution lifecycle. When an asynchronous request encounters a catastrophic failure before receiving a valid HTTP response—specifically scenarios involving connection resets, network timeouts, or transport-layer aborts—the callback or execution handler fails to remove the corresponding tracking state from the internal collections maintained by the interceptor.\nConsequently, dangling references to the request objects and their associated metric contexts remain allocated in the JVM heap indefinitely. Because the lifecycle completion hooks are bypassed or fail to execute under these specific error conditions, garbage collection cannot reclaim the memory.\nThe attack flow or trigger mechanism proceeds as follows: 1) An application initiates an asynchronous HTTP request using the instrumented Apache HttpAsyncClient. 2) The MicrometerHttpClientInterceptor registers tracking metadata for the outgoing request. 3) An external network failure, firewall drop, connection reset, or configured timeout interrupts the connection before a response payload or error status is formally processed by the standard response handler. 4) The asynchronous transport layer signals a failure, but the interception layer fails to purge the corresponding metric state entry. 5) Repeated occurrences accumulate orphaned objects within internal data structures.\nSustained exposure to connection failures or targeted generation of failing requests results in linear heap growth. Eventually, the JVM reaches its maximum heap capacity, triggering an OutOfMemoryError and causing an abrupt crash of the affected Java process, achieving a complete denial of service.\nThe network exposure depends on the application architecture utilizing the vulnerable client, but typically affects outbound or inter-service communications. No privileges or authentication credentials are required to cause the underlying transport failures if network conditions or inputs can be manipulated to induce timeouts or resets."
}