CVE-2026-59296 (GCVE-0-2026-59296)

Vulnerability from cvelistv5 – Published: 2026-08-21 10:47 – Updated: 2026-08-27 17:57
VLAI
Title
Micrometer StatsD and Logging meter registries line-protocol and log injection vulnerability
Summary
Using untrusted, non-normalized input as-is for metrics data (such as metric names, tag keys, or tag values) is a dangerous antipattern that general-purpose instrumentation should never perform. Micrometer 1.17.0 Micrometer 1.16.0 - 1.16.6 Micrometer 1.15.0 - 1.15.12 Micrometer 1.14.0 - 1.14.16 Micrometer 1.9.18 and earlier
Severity
5.9 (Medium)
CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:H/A:N
SSVC
Exploitation: none Automatable: no Technical Impact: partial
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2026-08-21 11:55 UTC
CWE
Assigner
vmware CNA under the mitre root
CNA scorecard C 64/100 over 252 records in the last 180 days details
References
Impacted products
Vendor Product Version CPE status
Spring Micrometer Affected: 1.17.0 (custom)
Affected: 1.16.0 , ≤ 1.16.6 (custom)
Affected: 1.15.0 , ≤ 1.15.12 (custom)
Affected: 1.14.0 , ≤ 1.14.16 (custom)
Affected: 0 , ≤ 1.9.18 (custom)
guessed Create a notification for this product.
Show details on NVD website
To clipboard 

{
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2026-59296",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "partial"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2026-08-21T11:55:29.457945Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "problemTypes": [
          {
            "descriptions": [
              {
                "cweId": "CWE-74",
                "description": "CWE-74 Improper Neutralization of Special Elements in Output Used by a Downstream Component (\u0027Injection\u0027)",
                "lang": "en",
                "type": "CWE"
              }
            ]
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2026-08-21T16:44:12.342Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "Micrometer",
          "vendor": "Spring",
          "versions": [
            {
              "status": "affected",
              "version": "1.17.0",
              "versionType": "custom"
            },
            {
              "lessThanOrEqual": "1.16.6",
              "status": "affected",
              "version": "1.16.0",
              "versionType": "custom"
            },
            {
              "lessThanOrEqual": "1.15.12",
              "status": "affected",
              "version": "1.15.0",
              "versionType": "custom"
            },
            {
              "lessThanOrEqual": "1.14.16",
              "status": "affected",
              "version": "1.14.0",
              "versionType": "custom"
            },
            {
              "lessThanOrEqual": "1.9.18",
              "status": "affected",
              "version": "0",
              "versionType": "custom"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "supportingMedia": [
            {
              "base64": false,
              "type": "text/html",
              "value": "\u003cp\u003eUsing untrusted, non-normalized input as-is for metrics data (such as metric names, tag keys, or tag values) is a dangerous antipattern that general-purpose instrumentation should never perform.\u003c/p\u003e\u003cp\u003eMicrometer 1.17.0\u003cbr/\u003eMicrometer 1.16.0 - 1.16.6\u003cbr/\u003eMicrometer 1.15.0 - 1.15.12\u003cbr/\u003eMicrometer 1.14.0 - 1.14.16\u003cbr/\u003eMicrometer 1.9.18 and earlier\u003c/p\u003e"
            }
          ],
          "value": "Using untrusted, non-normalized input as-is for metrics data (such as metric names, tag keys, or tag values) is a dangerous antipattern that general-purpose instrumentation should never perform.\nMicrometer 1.17.0\nMicrometer 1.16.0 - 1.16.6\nMicrometer 1.15.0 - 1.15.12\nMicrometer 1.14.0 - 1.14.16\nMicrometer 1.9.18 and earlier"
        }
      ],
      "impacts": [
        {
          "descriptions": [
            {
              "lang": "en",
              "value": "Using untrusted, non-normalized input as-is for metrics data (such as metric names, tag keys, or tag values) is a dangerous antipattern that general-purpose instrumentation should never perform."
            }
          ]
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "attackComplexity": "HIGH",
            "attackVector": "NETWORK",
            "availabilityImpact": "NONE",
            "baseScore": 5.9,
            "baseSeverity": "MEDIUM",
            "confidentialityImpact": "NONE",
            "integrityImpact": "HIGH",
            "privilegesRequired": "NONE",
            "scope": "UNCHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:H/A:N",
            "version": "3.1"
          },
          "format": "CVSS",
          "scenarios": [
            {
              "lang": "en",
              "value": "GENERAL"
            }
          ]
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "description": "CWE-117 Improper Output Neutralization for Logs",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-08-27T17:57:53.054Z",
        "orgId": "dcf2e128-44bd-42ed-91e8-88f912c1401d",
        "shortName": "vmware"
      },
      "references": [
        {
          "url": "https://spring.io/security/cve-2026-59296"
        }
      ],
      "source": {
        "discovery": "UNKNOWN"
      },
      "title": "Micrometer StatsD and Logging meter registries line-protocol and log injection vulnerability"
    }
  },
  "cveMetadata": {
    "assignerOrgId": "dcf2e128-44bd-42ed-91e8-88f912c1401d",
    "assignerShortName": "vmware",
    "cveId": "CVE-2026-59296",
    "datePublished": "2026-08-21T10:47:25.384Z",
    "dateReserved": "2026-07-04T18:13:34.323Z",
    "dateUpdated": "2026-08-27T17:57:53.054Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2",
  "vulnerability-lookup:meta": {
    "epss": {
      "cve": "CVE-2026-59296",
      "date": "2026-10-18",
      "epss": "0.00301",
      "percentile": "0.21367"
    },
    "nvd": {
      "cve": {
        "affected": [
          {
            "affectedData": [
              {
                "defaultStatus": "unaffected",
                "product": "Micrometer",
                "vendor": "Spring",
                "versions": [
                  {
                    "status": "affected",
                    "version": "1.17.0",
                    "versionType": "custom"
                  },
                  {
                    "lessThanOrEqual": "1.16.6",
                    "status": "affected",
                    "version": "1.16.0",
                    "versionType": "custom"
                  },
                  {
                    "lessThanOrEqual": "1.15.12",
                    "status": "affected",
                    "version": "1.15.0",
                    "versionType": "custom"
                  },
                  {
                    "lessThanOrEqual": "1.14.16",
                    "status": "affected",
                    "version": "1.14.0",
                    "versionType": "custom"
                  },
                  {
                    "lessThanOrEqual": "1.9.18",
                    "status": "affected",
                    "version": "0",
                    "versionType": "custom"
                  }
                ]
              }
            ],
            "source": "security@vmware.com"
          }
        ],
        "cveTags": [],
        "descriptions": [
          {
            "lang": "en",
            "value": "Using untrusted, non-normalized input as-is for metrics data (such as metric names, tag keys, or tag values) is a dangerous antipattern that general-purpose instrumentation should never perform.\nMicrometer 1.17.0\nMicrometer 1.16.0 - 1.16.6\nMicrometer 1.15.0 - 1.15.12\nMicrometer 1.14.0 - 1.14.16\nMicrometer 1.9.18 and earlier"
          },
          {
            "lang": "es",
            "value": "Usar entrada no confiable y no normalizada tal cual para datos de m\u00e9tricas (como nombres de m\u00e9tricas, claves de etiquetas o valores de etiquetas) es un antipatr\u00f3n peligroso que la instrumentaci\u00f3n de prop\u00f3sito general nunca deber\u00eda realizar. Cuando se utiliza dicha instrumentaci\u00f3n insegura, la aplicaci\u00f3n se vuelve vulnerable a ataques de inyecci\u00f3n y suplantaci\u00f3n porque micrometer-registry-statsd y micrometer-core no sanean los caracteres de nueva l\u00ednea (\\n, \\r) por defecto antes de esta correcci\u00f3n.\n\n*   Para el registro StatsD en micrometer-registry-statsd (cuando se utiliza la variante Datadog o Etsy), debido a que el protocolo StatsD est\u00e1 delimitado por nueva l\u00ednea, esto permite la inyecci\u00f3n de protocolo de l\u00ednea (suplantaci\u00f3n de m\u00e9tricas cruzadas).\n*   Para LoggingMeterRegistry en micrometer-core, debido a que la salida de m\u00e9tricas se imprime l\u00ednea por l\u00ednea en los archivos de registro, esto permite tanto la suplantaci\u00f3n de m\u00e9tricas (si los raspadores o analizadores de m\u00e9tricas de registro posteriores ingieren las l\u00edneas de registro como m\u00e9tricas separadas) como la suplantaci\u00f3n general de registros.\n\nEspec\u00edficamente, una aplicaci\u00f3n es vulnerable cuando se cumplen todas las siguientes condiciones:\n\n*   La aplicaci\u00f3n utiliza una versi\u00f3n vulnerable de io.micrometer:micrometer-registry-statsd o io.micrometer:micrometer-core.\n*   La aplicaci\u00f3n utiliza la variante Datadog o Etsy del registro StatsD, o utiliza LoggingMeterRegistry.\n*   La aplicaci\u00f3n instrumenta medidores utilizando entrada controlada por el usuario y no validada para nombres de m\u00e9tricas, claves de etiquetas o valores de etiquetas.\n\nCuando es vulnerable, un atacante puede escapar de la m\u00e9trica o l\u00ednea de registro actual inyectando terminadores de l\u00ednea. Esto les permite suplantar m\u00e9tricas arbitrarias (por ejemplo, carga del sistema, m\u00e9tricas JVM est\u00e1ndar u otras m\u00e9tricas de negocio) en todo el espacio de nombres del registro de m\u00e9tricas (ya sea directamente a trav\u00e9s del protocolo StatsD o a trav\u00e9s de raspadores/analizadores de m\u00e9tricas de registro posteriores), as\u00ed como inyectar entradas de registro arbitrarias para suplantar registros de registro generales."
          }
        ],
        "id": "CVE-2026-59296",
        "lastModified": "2026-10-16T15:10:00.103",
        "metrics": {
          "cvssMetricV31": [
            {
              "cvssData": {
                "attackComplexity": "HIGH",
                "attackVector": "NETWORK",
                "availabilityImpact": "NONE",
                "baseScore": 5.9,
                "baseSeverity": "MEDIUM",
                "confidentialityImpact": "NONE",
                "integrityImpact": "HIGH",
                "privilegesRequired": "NONE",
                "scope": "UNCHANGED",
                "userInteraction": "NONE",
                "vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:H/A:N",
                "version": "3.1"
              },
              "exploitabilityScore": 2.2,
              "impactScore": 3.6,
              "source": "security@vmware.com",
              "type": "Secondary"
            }
          ],
          "ssvcV203": [
            {
              "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
              "ssvcData": {
                "id": "CVE-2026-59296",
                "options": [
                  {
                    "exploitation": "none"
                  },
                  {
                    "automatable": "no"
                  },
                  {
                    "technicalImpact": "partial"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2026-08-21T11:55:29.457945Z",
                "version": "2.0.3"
              }
            }
          ]
        },
        "published": "2026-08-21T11:17:05.780",
        "references": [
          {
            "source": "security@vmware.com",
            "url": "https://spring.io/security/cve-2026-59296"
          }
        ],
        "sourceIdentifier": "security@vmware.com",
        "vulnStatus": "Awaiting Analysis",
        "weaknesses": [
          {
            "description": [
              {
                "lang": "en",
                "value": "CWE-74"
              }
            ],
            "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
            "type": "Secondary"
          }
        ]
      }
    },
    "redhat_vex": {
      "aggregate_severity": "Moderate",
      "current_release_date": "2026-10-16T11:24:09+00:00",
      "cve": "CVE-2026-59296",
      "id": "CVE-2026-59296",
      "initial_release_date": "2026-08-21T10:47:25.384000+00:00",
      "product_status:fixed": "13",
      "product_status:known_affected": "13",
      "product_status:known_not_affected": "2135",
      "source": "Red Hat CSAF VEX",
      "status": "final",
      "title": "io.micrometer/micrometer-registry-statsd: io.micrometer/micrometer-core: Micrometer: Line-protocol and log injection via unsanitized input allows metric and log spoofing",
      "url": "https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-59296.json",
      "version": "3"
    },
    "vulnrichment": {
      "containers": {
        "adp": [
          {
            "metrics": [
              {
                "other": {
                  "content": {
                    "id": "CVE-2026-59296",
                    "options": [
                      {
                        "Exploitation": "none"
                      },
                      {
                        "Automatable": "no"
                      },
                      {
                        "Technical Impact": "partial"
                      }
                    ],
                    "role": "CISA Coordinator",
                    "timestamp": "2026-08-21T11:55:29.457945Z",
                    "version": "2.0.3"
                  },
                  "type": "ssvc"
                }
              }
            ],
            "problemTypes": [
              {
                "descriptions": [
                  {
                    "cweId": "CWE-74",
                    "description": "CWE-74 Improper Neutralization of Special Elements in Output Used by a Downstream Component (\u0027Injection\u0027)",
                    "lang": "en",
                    "type": "CWE"
                  }
                ]
              }
            ],
            "providerMetadata": {
              "dateUpdated": "2026-08-21T11:55:35.874Z",
              "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
              "shortName": "CISA-ADP"
            },
            "title": "CISA ADP Vulnrichment"
          }
        ],
        "cna": {
          "affected": [
            {
              "defaultStatus": "affected",
              "product": "Spring Micrometer",
              "vendor": "VMware",
              "versions": [
                {
                  "status": "affected",
                  "version": "1.17.0 - 1.17.0"
                },
                {
                  "status": "affected",
                  "version": "1.16.0 - 1.16.6"
                },
                {
                  "status": "affected",
                  "version": "1.15.0 - 1.15.12"
                },
                {
                  "status": "affected",
                  "version": "1.14.0 - 1.14.16"
                },
                {
                  "status": "affected",
                  "version": "1.9.18 and earlier"
                },
                {
                  "status": "unaffected",
                  "version": "1.17.0.1",
                  "versionType": "enterprise support only"
                },
                {
                  "status": "unaffected",
                  "version": "1.17.1",
                  "versionType": "oss"
                },
                {
                  "status": "unaffected",
                  "version": "1.16.6.1",
                  "versionType": "enterprise support only"
                },
                {
                  "status": "unaffected",
                  "version": "1.16.7",
                  "versionType": "oss"
                },
                {
                  "status": "unaffected",
                  "version": "1.15.13",
                  "versionType": "enterprise support only"
                },
                {
                  "status": "unaffected",
                  "version": "1.14.17",
                  "versionType": "enterprise support only"
                },
                {
                  "status": "unaffected",
                  "version": "1.9.19",
                  "versionType": "enterprise support only"
                }
              ]
            }
          ],
          "datePublic": "2026-08-20T10:42:00.000Z",
          "descriptions": [
            {
              "lang": "en",
              "supportingMedia": [
                {
                  "base64": false,
                  "type": "text/html",
                  "value": "\u003cp\u003eUsing untrusted, non-normalized input as-is for metrics data (such as metric names, tag keys, or tag values) is a dangerous antipattern that general-purpose instrumentation should never perform. When such unsafe instrumentation is used, the application becomes vulnerable to injection and spoofing attacks because\u0026nbsp;\u003ccode\u003emicrometer-registry-statsd\u003c/code\u003e\u0026nbsp;and\u0026nbsp;\u003ccode\u003emicrometer-core\u003c/code\u003e\u0026nbsp;do not sanitize newline characters (\u003ccode\u003e\\n\u003c/code\u003e,\u0026nbsp;\u003ccode\u003e\\r\u003c/code\u003e) by default prior to this fix.\u003c/p\u003e\u003cul\u003e\u003cli\u003eFor the StatsD registry in\u0026nbsp;\u003ccode\u003emicrometer-registry-statsd\u003c/code\u003e\u0026nbsp;(when using the\u0026nbsp;\u003ccode\u003eDatadog\u003c/code\u003e\u0026nbsp;or\u0026nbsp;\u003ccode\u003eEtsy\u003c/code\u003e\u0026nbsp;flavor), because the StatsD protocol is newline-delimited, this allows for line-protocol injection (cross-metric spoofing).\u003c/li\u003e\u003cli\u003eFor\u0026nbsp;\u003ccode\u003eLoggingMeterRegistry\u003c/code\u003e\u0026nbsp;in\u0026nbsp;\u003ccode\u003emicrometer-core\u003c/code\u003e, because metric output is printed line-by-line to log files, this allows for both metric spoofing (if downstream log-metrics scrapers or parsers ingest the log lines as separate metrics) and general log spoofing.\u003c/li\u003e\u003c/ul\u003e\u003cp\u003eSpecifically, an application is vulnerable when all the following are true:\u003c/p\u003e\u003cul\u003e\u003cli\u003eThe application uses a vulnerable version of\u0026nbsp;\u003ccode\u003eio.micrometer:micrometer-registry-statsd\u003c/code\u003e\u0026nbsp;or\u0026nbsp;\u003ccode\u003eio.micrometer:micrometer-core\u003c/code\u003e.\u003c/li\u003e\u003cli\u003eThe application uses the\u0026nbsp;\u003ccode\u003eDatadog\u003c/code\u003e\u0026nbsp;or\u0026nbsp;\u003ccode\u003eEtsy\u003c/code\u003e\u0026nbsp;flavor of the StatsD registry, or uses\u0026nbsp;\u003ccode\u003eLoggingMeterRegistry\u003c/code\u003e.\u003c/li\u003e\u003cli\u003eThe application instruments meters using user-controlled, unvalidated input for metric names, tag keys, or tag values.\u003c/li\u003e\u003c/ul\u003e\u003cp\u003eWhen vulnerable, an attacker can break out of the current metric or log line by injecting line terminators. This allows them to spoof arbitrary metrics (e.g., system load, standard JVM metrics, or other business metrics) across the metrics registry namespace (either directly via StatsD protocol or via downstream log-metric scrapers/parsers), as well as inject arbitrary log entries to spoof general log records.\u003c/p\u003e"
                }
              ],
              "value": "Using untrusted, non-normalized input as-is for metrics data (such as metric names, tag keys, or tag values) is a dangerous antipattern that general-purpose instrumentation should never perform. When such unsafe instrumentation is used, the application becomes vulnerable to injection and spoofing attacks because\u00a0micrometer-registry-statsd\u00a0and\u00a0micrometer-core\u00a0do not sanitize newline characters (\\n,\u00a0\\r) by default prior to this fix.\n\n  *  For the StatsD registry in\u00a0micrometer-registry-statsd\u00a0(when using the\u00a0Datadog\u00a0or\u00a0Etsy\u00a0flavor), because the StatsD protocol is newline-delimited, this allows for line-protocol injection (cross-metric spoofing).\n  *  For\u00a0LoggingMeterRegistry\u00a0in\u00a0micrometer-core, because metric output is printed line-by-line to log files, this allows for both metric spoofing (if downstream log-metrics scrapers or parsers ingest the log lines as separate metrics) and general log spoofing.\n\n\n\n\nSpecifically, an application is vulnerable when all the following are true:\n\n  *  The application uses a vulnerable version of\u00a0io.micrometer:micrometer-registry-statsd\u00a0or\u00a0io.micrometer:micrometer-core.\n  *  The application uses the\u00a0Datadog\u00a0or\u00a0Etsy\u00a0flavor of the StatsD registry, or uses\u00a0LoggingMeterRegistry.\n  *  The application instruments meters using user-controlled, unvalidated input for metric names, tag keys, or tag values.\n\n\n\n\nWhen vulnerable, an attacker can break out of the current metric or log line by injecting line terminators. This allows them to spoof arbitrary metrics (e.g., system load, standard JVM metrics, or other business metrics) across the metrics registry namespace (either directly via StatsD protocol or via downstream log-metric scrapers/parsers), as well as inject arbitrary log entries to spoof general log records."
            }
          ],
          "metrics": [
            {
              "cvssV3_1": {
                "attackComplexity": "HIGH",
                "attackVector": "NETWORK",
                "availabilityImpact": "NONE",
                "baseScore": 5.9,
                "baseSeverity": "MEDIUM",
                "confidentialityImpact": "NONE",
                "integrityImpact": "HIGH",
                "privilegesRequired": "NONE",
                "scope": "UNCHANGED",
                "userInteraction": "NONE",
                "vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:H/A:N",
                "version": "3.1"
              },
              "format": "CVSS",
              "scenarios": [
                {
                  "lang": "en",
                  "value": "GENERAL"
                }
              ]
            }
          ],
          "providerMetadata": {
            "dateUpdated": "2026-08-21T10:47:25.384Z",
            "orgId": "dcf2e128-44bd-42ed-91e8-88f912c1401d",
            "shortName": "vmware"
          },
          "references": [
            {
              "url": "https://spring.io/security/cve-2026-59296"
            }
          ],
          "source": {
            "discovery": "UNKNOWN"
          },
          "title": "Micrometer StatsD and Logging meter registries line-protocol and log injection vulnerability",
          "x_generator": {
            "engine": "Vulnogram 1.0.4"
          }
        }
      },
      "cveMetadata": {
        "assignerOrgId": "dcf2e128-44bd-42ed-91e8-88f912c1401d",
        "assignerShortName": "vmware",
        "cveId": "CVE-2026-59296",
        "datePublished": "2026-08-21T10:47:25.384Z",
        "dateReserved": "2026-07-04T18:13:34.323Z",
        "dateUpdated": "2026-08-21T16:44:12.342Z",
        "state": "PUBLISHED"
      },
      "dataType": "CVE_RECORD",
      "dataVersion": "5.2"
    }
  }
}



Log in or create an account to share your comment.




Tags
Taxonomy of the tags.




Drag nodes to arrange them. Double-click a related vulnerability to open it, or a source to visit its link. The Physics button on the left tunes the layout and the simulation; the legend at the bottom left hides or shows nodes by kind and by sighting type.

Forecast uses a logistic model when the trend is rising, or an exponential decay model when the trend is falling. Fitted via linearized least squares.

Sightings

Author Source Type Date Other

Nomenclature

  • Seen: The vulnerability was mentioned, discussed, or observed by the user.
  • Confirmed: The vulnerability has been validated from an analyst's perspective.
  • Published Proof of Concept: A public proof of concept is available for this vulnerability.
  • Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
  • Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
  • Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
  • Not confirmed: The user expressed doubt about the validity of the vulnerability.
  • Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.
Vulnerability timeline

Sightings and recorded dates, grouped by day · UTC

JSON

Loading timeline…




    Related by attack behaviour

    Vulnerabilities whose description is nearest to this one in the vector space of the CIRCL/vulnerability-attack-technique-biencoder model. This is a similarity search over the bi-encoder space (plain cosine), not a classification, and it has no measured accuracy.