CVE-2026-59323

Name of the Vulnerable Software and Affected Versions io.micrometer:micrometer-tracing-bridge-brave (affected versions not specified)

Description An application using Micrometer Tracing with W3C baggage propagation in the Brave bridge is susceptible to denial of service (DoS). The issue occurs during the extraction of incoming baggage headers when the application parses entries without enforcing limits on the number of entries or the header size, contrary to the W3C Baggage specification. An attacker can send requests containing artificially inflated baggage headers with numerous key-value pairs, triggering unconditional BaggageField allocations. This results in excessive garbage collection pressure, high CPU usage, and potential application crashes due to OutOfMemoryError. This condition is met when W3C propagation is active, baggage propagation is enabled with a configured baggage manager (such as BraveBaggageManager), and the application processes requests from untrusted sources without sufficient header size limits imposed by network components or the HTTP server.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.