CVE-2026-59323 VMware CVE debrief

Who should care

Developers and administrators of applications using Micrometer Tracing with W3C baggage propagation in the Brave bridge should be aware of this vulnerability and take necessary actions to prevent potential denial of service (DoS) attacks. This includes verifying the application uses a non-vulnerable version of io.micrometer:micrometer-tracing-bridge-brave, reviewing W3C propagation and baggage propagation configurations, and implementing limits on header size and entries.

Technical summary

The application using Micrometer Tracing with W3C baggage propagation in the Brave bridge is vulnerable to denial of service (DoS) due to unbounded object allocation when extracting incoming baggage headers. The vulnerability exists when the application uses a vulnerable version of io.micrometer:micrometer-tracing-bridge-brave, W3C propagation is active, baggage propagation is enabled, and a baggage manager is configured to handle baggage fields. Specifically, an application is vulnerable when all the following are true: The application uses a vulnerable version of io.micrometer:micrometer-tracing-bridge-brave. W3C propagation is active (either configured manually or active by default, such as in Spring Boot 3.x+). Baggage propagation is enabled (which is the default in Spring Boot 3.x+) and a baggage manager (such as BraveBaggageManager) is configured to handle baggage fields. The application processes requests or messages from untrusted sources with baggage headers which it normally should not.

Defensive priority

Medium-priority defensive actions are required to address the denial of service (DoS) vulnerability in Micrometer Tracing with W3C baggage propagation in the Brave bridge.

Recommended defensive actions

• Verify the application uses a non-vulnerable version of io.micrometer:micrometer-tracing-bridge-brave.
• Review W3C propagation and baggage propagation configurations to ensure they are properly set up.
• Implement limits on header size and entries to prevent unbounded object allocation.
• Monitor application performance and adjust configurations as needed to prevent potential crashes.
• Review compensating controls for exposed systems while remediation is scheduled and verified.
• Check relevant monitoring, detection, and logs for exposed assets that need extra review.
• Track exceptions, retest remediated assets, and close the item only after evidence is documented.

Evidence notes

The CVE record indicates a medium-severity vulnerability in Micrometer Tracing with W3C baggage propagation in the Brave bridge, allowing for denial of service (DoS) attacks due to unbounded object allocation. Evidence is limited, and further verification is required to determine the full scope of the vulnerability. The application processes requests or messages from untrusted sources with baggage headers which it normally should not. Network components including the (HTTP) server that receives the request do not limit the header size or the limit is high enough to cause issues.

Official resources