What is CVE-2026-59295?

CVE-2026-59295 is a medium-severity vulnerability in VMware (Broadcom) Io.micrometer:micrometer-Core, classified under Missing Release of Memory after Effective Lifetime. CVSS score: 5.9/10. Published 2026-08-24.

How severe is CVE-2026-59295?

Medium severity. CVSS v3 base score is 5.9 out of 10.

Vulnerability in VMware (Broadcom) Io.micrometer:micrometer-Core

CVE-2026-59295

Micrometer-instrumented Apache HttpAsyncClient (4.x or 5.x) usage via MicrometerHttpClientInterceptor can leak memory unboundedly when asynchronous requests fail before receiving a response (e.g. connection resets or timeouts). Tracking state for these requests remains in memory indefinitely, and sustained failures lead to heap exhaustion and OutOfMemoryError crashes.

CVSS v3 metric

CVSS v3 base score 5.9 (Medium). Vector: CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H.

Affected products

Vmware (Broadcom) Io.micrometer:micrometer-core — versions 1.17.0

Weakness classification (CWE)

CWE-401 — Missing Release of Memory after Effective Lifetime

References

Frequently asked questions

What is CVE-2026-59295?: CVE-2026-59295 is a medium-severity vulnerability in VMware (Broadcom) Io.micrometer:micrometer-Core, classified under Missing Release of Memory after Effective Lifetime. CVSS score: 5.9/10. Published 2026-08-24.
How severe is CVE-2026-59295?: Medium severity. CVSS v3 base score is 5.9 out of 10.