Search
Find a vulnerability
Search criteria
ⓘ
Use this form to refine search results.
Full-text search supports keyword queries with ranking and filtering.
You can combine vendor, product, and sources to narrow results.
Enable “Apply ordering” to sort by date instead of relevance.
2 vulnerabilities found for Spring Micrometer by VMware
CVE-2026-59296 (GCVE-0-2026-59296)
Vulnerability from nvd – Published: 2026-08-21 10:47 – Updated: 2026-08-21 16:44
VLAI
EPSS
VEX
Title
Micrometer StatsD and Logging meter registries line-protocol and log injection vulnerability
Summary
Using untrusted, non-normalized input as-is for metrics data (such as metric names, tag keys, or tag values) is a dangerous antipattern that general-purpose instrumentation should never perform. When such unsafe instrumentation is used, the application becomes vulnerable to injection and spoofing attacks because micrometer-registry-statsd and micrometer-core do not sanitize newline characters (\n, \r) by default prior to this fix.
* For the StatsD registry in micrometer-registry-statsd (when using the Datadog or Etsy flavor), because the StatsD protocol is newline-delimited, this allows for line-protocol injection (cross-metric spoofing).
* For LoggingMeterRegistry in micrometer-core, because metric output is printed line-by-line to log files, this allows for both metric spoofing (if downstream log-metrics scrapers or parsers ingest the log lines as separate metrics) and general log spoofing.
Specifically, an application is vulnerable when all the following are true:
* The application uses a vulnerable version of io.micrometer:micrometer-registry-statsd or io.micrometer:micrometer-core.
* The application uses the Datadog or Etsy flavor of the StatsD registry, or uses LoggingMeterRegistry.
* The application instruments meters using user-controlled, unvalidated input for metric names, tag keys, or tag values.
When vulnerable, an attacker can break out of the current metric or log line by injecting line terminators. This allows them to spoof arbitrary metrics (e.g., system load, standard JVM metrics, or other business metrics) across the metrics registry namespace (either directly via StatsD protocol or via downstream log-metric scrapers/parsers), as well as inject arbitrary log entries to spoof general log records.
Severity
5.9 (Medium)
SSVC
Exploitation: none
Automatable: no
Technical Impact: partial
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2026-08-21 11:55 UTC
CWE
- CWE-74 - Improper Neutralization of Special Elements in Output Used by a Downstream Component ('Injection')
Assigner
References
1 reference
Impacted products
1 product
| Vendor | Product | Version | |
|---|---|---|---|
| VMware | Spring Micrometer |
Affected:
1.17.0 - 1.17.0
Affected: 1.16.0 - 1.16.6 Affected: 1.15.0 - 1.15.12 Affected: 1.14.0 - 1.14.16 Affected: 1.9.18 and earlier Unaffected: 1.17.0.1 (enterprise support only) Unaffected: 1.17.1 (oss) Unaffected: 1.16.6.1 (enterprise support only) Unaffected: 1.16.7 (oss) Unaffected: 1.15.13 (enterprise support only) Unaffected: 1.14.17 (enterprise support only) Unaffected: 1.9.19 (enterprise support only) |
Date Public
2026-08-20 10:42
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2026-59296",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "no"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-08-21T11:55:29.457945Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-74",
"description": "CWE-74 Improper Neutralization of Special Elements in Output Used by a Downstream Component (\u0027Injection\u0027)",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-08-21T16:44:12.342Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"defaultStatus": "affected",
"product": "Spring Micrometer",
"vendor": "VMware",
"versions": [
{
"status": "affected",
"version": "1.17.0 - 1.17.0"
},
{
"status": "affected",
"version": "1.16.0 - 1.16.6"
},
{
"status": "affected",
"version": "1.15.0 - 1.15.12"
},
{
"status": "affected",
"version": "1.14.0 - 1.14.16"
},
{
"status": "affected",
"version": "1.9.18 and earlier"
},
{
"status": "unaffected",
"version": "1.17.0.1",
"versionType": "enterprise support only"
},
{
"status": "unaffected",
"version": "1.17.1",
"versionType": "oss"
},
{
"status": "unaffected",
"version": "1.16.6.1",
"versionType": "enterprise support only"
},
{
"status": "unaffected",
"version": "1.16.7",
"versionType": "oss"
},
{
"status": "unaffected",
"version": "1.15.13",
"versionType": "enterprise support only"
},
{
"status": "unaffected",
"version": "1.14.17",
"versionType": "enterprise support only"
},
{
"status": "unaffected",
"version": "1.9.19",
"versionType": "enterprise support only"
}
]
}
],
"datePublic": "2026-08-20T10:42:00.000Z",
"descriptions": [
{
"lang": "en",
"supportingMedia": [
{
"base64": false,
"type": "text/html",
"value": "\u003cp\u003eUsing untrusted, non-normalized input as-is for metrics data (such as metric names, tag keys, or tag values) is a dangerous antipattern that general-purpose instrumentation should never perform. When such unsafe instrumentation is used, the application becomes vulnerable to injection and spoofing attacks because\u0026nbsp;\u003ccode\u003emicrometer-registry-statsd\u003c/code\u003e\u0026nbsp;and\u0026nbsp;\u003ccode\u003emicrometer-core\u003c/code\u003e\u0026nbsp;do not sanitize newline characters (\u003ccode\u003e\\n\u003c/code\u003e,\u0026nbsp;\u003ccode\u003e\\r\u003c/code\u003e) by default prior to this fix.\u003c/p\u003e\u003cul\u003e\u003cli\u003eFor the StatsD registry in\u0026nbsp;\u003ccode\u003emicrometer-registry-statsd\u003c/code\u003e\u0026nbsp;(when using the\u0026nbsp;\u003ccode\u003eDatadog\u003c/code\u003e\u0026nbsp;or\u0026nbsp;\u003ccode\u003eEtsy\u003c/code\u003e\u0026nbsp;flavor), because the StatsD protocol is newline-delimited, this allows for line-protocol injection (cross-metric spoofing).\u003c/li\u003e\u003cli\u003eFor\u0026nbsp;\u003ccode\u003eLoggingMeterRegistry\u003c/code\u003e\u0026nbsp;in\u0026nbsp;\u003ccode\u003emicrometer-core\u003c/code\u003e, because metric output is printed line-by-line to log files, this allows for both metric spoofing (if downstream log-metrics scrapers or parsers ingest the log lines as separate metrics) and general log spoofing.\u003c/li\u003e\u003c/ul\u003e\u003cp\u003eSpecifically, an application is vulnerable when all the following are true:\u003c/p\u003e\u003cul\u003e\u003cli\u003eThe application uses a vulnerable version of\u0026nbsp;\u003ccode\u003eio.micrometer:micrometer-registry-statsd\u003c/code\u003e\u0026nbsp;or\u0026nbsp;\u003ccode\u003eio.micrometer:micrometer-core\u003c/code\u003e.\u003c/li\u003e\u003cli\u003eThe application uses the\u0026nbsp;\u003ccode\u003eDatadog\u003c/code\u003e\u0026nbsp;or\u0026nbsp;\u003ccode\u003eEtsy\u003c/code\u003e\u0026nbsp;flavor of the StatsD registry, or uses\u0026nbsp;\u003ccode\u003eLoggingMeterRegistry\u003c/code\u003e.\u003c/li\u003e\u003cli\u003eThe application instruments meters using user-controlled, unvalidated input for metric names, tag keys, or tag values.\u003c/li\u003e\u003c/ul\u003e\u003cp\u003eWhen vulnerable, an attacker can break out of the current metric or log line by injecting line terminators. This allows them to spoof arbitrary metrics (e.g., system load, standard JVM metrics, or other business metrics) across the metrics registry namespace (either directly via StatsD protocol or via downstream log-metric scrapers/parsers), as well as inject arbitrary log entries to spoof general log records.\u003c/p\u003e"
}
],
"value": "Using untrusted, non-normalized input as-is for metrics data (such as metric names, tag keys, or tag values) is a dangerous antipattern that general-purpose instrumentation should never perform. When such unsafe instrumentation is used, the application becomes vulnerable to injection and spoofing attacks because\u00a0micrometer-registry-statsd\u00a0and\u00a0micrometer-core\u00a0do not sanitize newline characters (\\n,\u00a0\\r) by default prior to this fix.\n\n * For the StatsD registry in\u00a0micrometer-registry-statsd\u00a0(when using the\u00a0Datadog\u00a0or\u00a0Etsy\u00a0flavor), because the StatsD protocol is newline-delimited, this allows for line-protocol injection (cross-metric spoofing).\n * For\u00a0LoggingMeterRegistry\u00a0in\u00a0micrometer-core, because metric output is printed line-by-line to log files, this allows for both metric spoofing (if downstream log-metrics scrapers or parsers ingest the log lines as separate metrics) and general log spoofing.\n\n\n\n\nSpecifically, an application is vulnerable when all the following are true:\n\n * The application uses a vulnerable version of\u00a0io.micrometer:micrometer-registry-statsd\u00a0or\u00a0io.micrometer:micrometer-core.\n * The application uses the\u00a0Datadog\u00a0or\u00a0Etsy\u00a0flavor of the StatsD registry, or uses\u00a0LoggingMeterRegistry.\n * The application instruments meters using user-controlled, unvalidated input for metric names, tag keys, or tag values.\n\n\n\n\nWhen vulnerable, an attacker can break out of the current metric or log line by injecting line terminators. This allows them to spoof arbitrary metrics (e.g., system load, standard JVM metrics, or other business metrics) across the metrics registry namespace (either directly via StatsD protocol or via downstream log-metric scrapers/parsers), as well as inject arbitrary log entries to spoof general log records."
}
],
"metrics": [
{
"cvssV3_1": {
"attackComplexity": "HIGH",
"attackVector": "NETWORK",
"availabilityImpact": "NONE",
"baseScore": 5.9,
"baseSeverity": "MEDIUM",
"confidentialityImpact": "NONE",
"integrityImpact": "HIGH",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:H/A:N",
"version": "3.1"
},
"format": "CVSS",
"scenarios": [
{
"lang": "en",
"value": "GENERAL"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-08-21T10:47:25.384Z",
"orgId": "dcf2e128-44bd-42ed-91e8-88f912c1401d",
"shortName": "vmware"
},
"references": [
{
"url": "https://spring.io/security/cve-2026-59296"
}
],
"source": {
"discovery": "UNKNOWN"
},
"title": "Micrometer StatsD and Logging meter registries line-protocol and log injection vulnerability",
"x_generator": {
"engine": "Vulnogram 1.0.4"
}
}
},
"cveMetadata": {
"assignerOrgId": "dcf2e128-44bd-42ed-91e8-88f912c1401d",
"assignerShortName": "vmware",
"cveId": "CVE-2026-59296",
"datePublished": "2026-08-21T10:47:25.384Z",
"dateReserved": "2026-07-04T18:13:34.323Z",
"dateUpdated": "2026-08-21T16:44:12.342Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-59296 (GCVE-0-2026-59296)
Vulnerability from cvelistv5 – Published: 2026-08-21 10:47 – Updated: 2026-08-21 16:44
VLAI
EPSS
VEX
Title
Micrometer StatsD and Logging meter registries line-protocol and log injection vulnerability
Summary
Using untrusted, non-normalized input as-is for metrics data (such as metric names, tag keys, or tag values) is a dangerous antipattern that general-purpose instrumentation should never perform. When such unsafe instrumentation is used, the application becomes vulnerable to injection and spoofing attacks because micrometer-registry-statsd and micrometer-core do not sanitize newline characters (\n, \r) by default prior to this fix.
* For the StatsD registry in micrometer-registry-statsd (when using the Datadog or Etsy flavor), because the StatsD protocol is newline-delimited, this allows for line-protocol injection (cross-metric spoofing).
* For LoggingMeterRegistry in micrometer-core, because metric output is printed line-by-line to log files, this allows for both metric spoofing (if downstream log-metrics scrapers or parsers ingest the log lines as separate metrics) and general log spoofing.
Specifically, an application is vulnerable when all the following are true:
* The application uses a vulnerable version of io.micrometer:micrometer-registry-statsd or io.micrometer:micrometer-core.
* The application uses the Datadog or Etsy flavor of the StatsD registry, or uses LoggingMeterRegistry.
* The application instruments meters using user-controlled, unvalidated input for metric names, tag keys, or tag values.
When vulnerable, an attacker can break out of the current metric or log line by injecting line terminators. This allows them to spoof arbitrary metrics (e.g., system load, standard JVM metrics, or other business metrics) across the metrics registry namespace (either directly via StatsD protocol or via downstream log-metric scrapers/parsers), as well as inject arbitrary log entries to spoof general log records.
Severity
5.9 (Medium)
SSVC
Exploitation: none
Automatable: no
Technical Impact: partial
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2026-08-21 11:55 UTC
CWE
- CWE-74 - Improper Neutralization of Special Elements in Output Used by a Downstream Component ('Injection')
Assigner
References
1 reference
Impacted products
1 product
| Vendor | Product | Version | |
|---|---|---|---|
| VMware | Spring Micrometer |
Affected:
1.17.0 - 1.17.0
Affected: 1.16.0 - 1.16.6 Affected: 1.15.0 - 1.15.12 Affected: 1.14.0 - 1.14.16 Affected: 1.9.18 and earlier Unaffected: 1.17.0.1 (enterprise support only) Unaffected: 1.17.1 (oss) Unaffected: 1.16.6.1 (enterprise support only) Unaffected: 1.16.7 (oss) Unaffected: 1.15.13 (enterprise support only) Unaffected: 1.14.17 (enterprise support only) Unaffected: 1.9.19 (enterprise support only) |
Date Public
2026-08-20 10:42
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2026-59296",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "no"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-08-21T11:55:29.457945Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-74",
"description": "CWE-74 Improper Neutralization of Special Elements in Output Used by a Downstream Component (\u0027Injection\u0027)",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-08-21T16:44:12.342Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"defaultStatus": "affected",
"product": "Spring Micrometer",
"vendor": "VMware",
"versions": [
{
"status": "affected",
"version": "1.17.0 - 1.17.0"
},
{
"status": "affected",
"version": "1.16.0 - 1.16.6"
},
{
"status": "affected",
"version": "1.15.0 - 1.15.12"
},
{
"status": "affected",
"version": "1.14.0 - 1.14.16"
},
{
"status": "affected",
"version": "1.9.18 and earlier"
},
{
"status": "unaffected",
"version": "1.17.0.1",
"versionType": "enterprise support only"
},
{
"status": "unaffected",
"version": "1.17.1",
"versionType": "oss"
},
{
"status": "unaffected",
"version": "1.16.6.1",
"versionType": "enterprise support only"
},
{
"status": "unaffected",
"version": "1.16.7",
"versionType": "oss"
},
{
"status": "unaffected",
"version": "1.15.13",
"versionType": "enterprise support only"
},
{
"status": "unaffected",
"version": "1.14.17",
"versionType": "enterprise support only"
},
{
"status": "unaffected",
"version": "1.9.19",
"versionType": "enterprise support only"
}
]
}
],
"datePublic": "2026-08-20T10:42:00.000Z",
"descriptions": [
{
"lang": "en",
"supportingMedia": [
{
"base64": false,
"type": "text/html",
"value": "\u003cp\u003eUsing untrusted, non-normalized input as-is for metrics data (such as metric names, tag keys, or tag values) is a dangerous antipattern that general-purpose instrumentation should never perform. When such unsafe instrumentation is used, the application becomes vulnerable to injection and spoofing attacks because\u0026nbsp;\u003ccode\u003emicrometer-registry-statsd\u003c/code\u003e\u0026nbsp;and\u0026nbsp;\u003ccode\u003emicrometer-core\u003c/code\u003e\u0026nbsp;do not sanitize newline characters (\u003ccode\u003e\\n\u003c/code\u003e,\u0026nbsp;\u003ccode\u003e\\r\u003c/code\u003e) by default prior to this fix.\u003c/p\u003e\u003cul\u003e\u003cli\u003eFor the StatsD registry in\u0026nbsp;\u003ccode\u003emicrometer-registry-statsd\u003c/code\u003e\u0026nbsp;(when using the\u0026nbsp;\u003ccode\u003eDatadog\u003c/code\u003e\u0026nbsp;or\u0026nbsp;\u003ccode\u003eEtsy\u003c/code\u003e\u0026nbsp;flavor), because the StatsD protocol is newline-delimited, this allows for line-protocol injection (cross-metric spoofing).\u003c/li\u003e\u003cli\u003eFor\u0026nbsp;\u003ccode\u003eLoggingMeterRegistry\u003c/code\u003e\u0026nbsp;in\u0026nbsp;\u003ccode\u003emicrometer-core\u003c/code\u003e, because metric output is printed line-by-line to log files, this allows for both metric spoofing (if downstream log-metrics scrapers or parsers ingest the log lines as separate metrics) and general log spoofing.\u003c/li\u003e\u003c/ul\u003e\u003cp\u003eSpecifically, an application is vulnerable when all the following are true:\u003c/p\u003e\u003cul\u003e\u003cli\u003eThe application uses a vulnerable version of\u0026nbsp;\u003ccode\u003eio.micrometer:micrometer-registry-statsd\u003c/code\u003e\u0026nbsp;or\u0026nbsp;\u003ccode\u003eio.micrometer:micrometer-core\u003c/code\u003e.\u003c/li\u003e\u003cli\u003eThe application uses the\u0026nbsp;\u003ccode\u003eDatadog\u003c/code\u003e\u0026nbsp;or\u0026nbsp;\u003ccode\u003eEtsy\u003c/code\u003e\u0026nbsp;flavor of the StatsD registry, or uses\u0026nbsp;\u003ccode\u003eLoggingMeterRegistry\u003c/code\u003e.\u003c/li\u003e\u003cli\u003eThe application instruments meters using user-controlled, unvalidated input for metric names, tag keys, or tag values.\u003c/li\u003e\u003c/ul\u003e\u003cp\u003eWhen vulnerable, an attacker can break out of the current metric or log line by injecting line terminators. This allows them to spoof arbitrary metrics (e.g., system load, standard JVM metrics, or other business metrics) across the metrics registry namespace (either directly via StatsD protocol or via downstream log-metric scrapers/parsers), as well as inject arbitrary log entries to spoof general log records.\u003c/p\u003e"
}
],
"value": "Using untrusted, non-normalized input as-is for metrics data (such as metric names, tag keys, or tag values) is a dangerous antipattern that general-purpose instrumentation should never perform. When such unsafe instrumentation is used, the application becomes vulnerable to injection and spoofing attacks because\u00a0micrometer-registry-statsd\u00a0and\u00a0micrometer-core\u00a0do not sanitize newline characters (\\n,\u00a0\\r) by default prior to this fix.\n\n * For the StatsD registry in\u00a0micrometer-registry-statsd\u00a0(when using the\u00a0Datadog\u00a0or\u00a0Etsy\u00a0flavor), because the StatsD protocol is newline-delimited, this allows for line-protocol injection (cross-metric spoofing).\n * For\u00a0LoggingMeterRegistry\u00a0in\u00a0micrometer-core, because metric output is printed line-by-line to log files, this allows for both metric spoofing (if downstream log-metrics scrapers or parsers ingest the log lines as separate metrics) and general log spoofing.\n\n\n\n\nSpecifically, an application is vulnerable when all the following are true:\n\n * The application uses a vulnerable version of\u00a0io.micrometer:micrometer-registry-statsd\u00a0or\u00a0io.micrometer:micrometer-core.\n * The application uses the\u00a0Datadog\u00a0or\u00a0Etsy\u00a0flavor of the StatsD registry, or uses\u00a0LoggingMeterRegistry.\n * The application instruments meters using user-controlled, unvalidated input for metric names, tag keys, or tag values.\n\n\n\n\nWhen vulnerable, an attacker can break out of the current metric or log line by injecting line terminators. This allows them to spoof arbitrary metrics (e.g., system load, standard JVM metrics, or other business metrics) across the metrics registry namespace (either directly via StatsD protocol or via downstream log-metric scrapers/parsers), as well as inject arbitrary log entries to spoof general log records."
}
],
"metrics": [
{
"cvssV3_1": {
"attackComplexity": "HIGH",
"attackVector": "NETWORK",
"availabilityImpact": "NONE",
"baseScore": 5.9,
"baseSeverity": "MEDIUM",
"confidentialityImpact": "NONE",
"integrityImpact": "HIGH",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:H/A:N",
"version": "3.1"
},
"format": "CVSS",
"scenarios": [
{
"lang": "en",
"value": "GENERAL"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-08-21T10:47:25.384Z",
"orgId": "dcf2e128-44bd-42ed-91e8-88f912c1401d",
"shortName": "vmware"
},
"references": [
{
"url": "https://spring.io/security/cve-2026-59296"
}
],
"source": {
"discovery": "UNKNOWN"
},
"title": "Micrometer StatsD and Logging meter registries line-protocol and log injection vulnerability",
"x_generator": {
"engine": "Vulnogram 1.0.4"
}
}
},
"cveMetadata": {
"assignerOrgId": "dcf2e128-44bd-42ed-91e8-88f912c1401d",
"assignerShortName": "vmware",
"cveId": "CVE-2026-59296",
"datePublished": "2026-08-21T10:47:25.384Z",
"dateReserved": "2026-07-04T18:13:34.323Z",
"dateUpdated": "2026-08-21T16:44:12.342Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}