Vulnerability-Lookup

CVE-2026-59296 (GCVE-0-2026-59296)

Vulnerability from cvelistv5 – Published: 2026-08-21 10:47 – Updated: 2026-08-21 16:44

Title

Micrometer StatsD and Logging meter registries line-protocol and log injection vulnerability

Summary

Using untrusted, non-normalized input as-is for metrics data (such as metric names, tag keys, or tag values) is a dangerous antipattern that general-purpose instrumentation should never perform. When such unsafe instrumentation is used, the application becomes vulnerable to injection and spoofing attacks because micrometer-registry-statsd and micrometer-core do not sanitize newline characters (\n, \r) by default prior to this fix. * For the StatsD registry in micrometer-registry-statsd (when using the Datadog or Etsy flavor), because the StatsD protocol is newline-delimited, this allows for line-protocol injection (cross-metric spoofing). * For LoggingMeterRegistry in micrometer-core, because metric output is printed line-by-line to log files, this allows for both metric spoofing (if downstream log-metrics scrapers or parsers ingest the log lines as separate metrics) and general log spoofing. Specifically, an application is vulnerable when all the following are true: * The application uses a vulnerable version of io.micrometer:micrometer-registry-statsd or io.micrometer:micrometer-core. * The application uses the Datadog or Etsy flavor of the StatsD registry, or uses LoggingMeterRegistry. * The application instruments meters using user-controlled, unvalidated input for metric names, tag keys, or tag values. When vulnerable, an attacker can break out of the current metric or log line by injecting line terminators. This allows them to spoof arbitrary metrics (e.g., system load, standard JVM metrics, or other business metrics) across the metrics registry namespace (either directly via StatsD protocol or via downstream log-metric scrapers/parsers), as well as inject arbitrary log entries to spoof general log records.

Severity

5.9 (Medium)


                        
                          CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:H/A:N

SSVC

Exploitation: none Automatable: no Technical Impact: partial

CISA Coordinator · CISA-ADP (v2.0.3)

Decision recorded 2026-08-21 11:55 UTC

CWE

CWE-74 - Improper Neutralization of Special Elements in Output Used by a Downstream Component ('Injection')

Assigner

vmware mitre root

References

1 reference

URL	Tags
https://spring.io/security/cve-2026-59296

Impacted products

1 product

Vendor	Product	Version	CPE status
VMware	Spring Micrometer	Affected: 1.17.0 - 1.17.0 Affected: 1.16.0 - 1.16.6 Affected: 1.15.0 - 1.15.12 Affected: 1.14.0 - 1.14.16 Affected: 1.9.18 and earlier Unaffected: 1.17.0.1 (enterprise support only) Unaffected: 1.17.1 (oss) Unaffected: 1.16.6.1 (enterprise support only) Unaffected: 1.16.7 (oss) Unaffected: 1.15.13 (enterprise support only) Unaffected: 1.14.17 (enterprise support only) Unaffected: 1.9.19 (enterprise support only)	guessed

Date Public

2026-08-20 10:42

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2026-59296",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "partial"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2026-08-21T11:55:29.457945Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "problemTypes": [
          {
            "descriptions": [
              {
                "cweId": "CWE-74",
                "description": "CWE-74 Improper Neutralization of Special Elements in Output Used by a Downstream Component (\u0027Injection\u0027)",
                "lang": "en",
                "type": "CWE"
              }
            ]
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2026-08-21T16:44:12.342Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "defaultStatus": "affected",
          "product": "Spring Micrometer",
          "vendor": "VMware",
          "versions": [
            {
              "status": "affected",
              "version": "1.17.0 - 1.17.0"
            },
            {
              "status": "affected",
              "version": "1.16.0 - 1.16.6"
            },
            {
              "status": "affected",
              "version": "1.15.0 - 1.15.12"
            },
            {
              "status": "affected",
              "version": "1.14.0 - 1.14.16"
            },
            {
              "status": "affected",
              "version": "1.9.18 and earlier"
            },
            {
              "status": "unaffected",
              "version": "1.17.0.1",
              "versionType": "enterprise support only"
            },
            {
              "status": "unaffected",
              "version": "1.17.1",
              "versionType": "oss"
            },
            {
              "status": "unaffected",
              "version": "1.16.6.1",
              "versionType": "enterprise support only"
            },
            {
              "status": "unaffected",
              "version": "1.16.7",
              "versionType": "oss"
            },
            {
              "status": "unaffected",
              "version": "1.15.13",
              "versionType": "enterprise support only"
            },
            {
              "status": "unaffected",
              "version": "1.14.17",
              "versionType": "enterprise support only"
            },
            {
              "status": "unaffected",
              "version": "1.9.19",
              "versionType": "enterprise support only"
            }
          ]
        }
      ],
      "datePublic": "2026-08-20T10:42:00.000Z",
      "descriptions": [
        {
          "lang": "en",
          "supportingMedia": [
            {
              "base64": false,
              "type": "text/html",
              "value": "\u003cp\u003eUsing untrusted, non-normalized input as-is for metrics data (such as metric names, tag keys, or tag values) is a dangerous antipattern that general-purpose instrumentation should never perform. When such unsafe instrumentation is used, the application becomes vulnerable to injection and spoofing attacks because\u0026nbsp;\u003ccode\u003emicrometer-registry-statsd\u003c/code\u003e\u0026nbsp;and\u0026nbsp;\u003ccode\u003emicrometer-core\u003c/code\u003e\u0026nbsp;do not sanitize newline characters (\u003ccode\u003e\\n\u003c/code\u003e,\u0026nbsp;\u003ccode\u003e\\r\u003c/code\u003e) by default prior to this fix.\u003c/p\u003e\u003cul\u003e\u003cli\u003eFor the StatsD registry in\u0026nbsp;\u003ccode\u003emicrometer-registry-statsd\u003c/code\u003e\u0026nbsp;(when using the\u0026nbsp;\u003ccode\u003eDatadog\u003c/code\u003e\u0026nbsp;or\u0026nbsp;\u003ccode\u003eEtsy\u003c/code\u003e\u0026nbsp;flavor), because the StatsD protocol is newline-delimited, this allows for line-protocol injection (cross-metric spoofing).\u003c/li\u003e\u003cli\u003eFor\u0026nbsp;\u003ccode\u003eLoggingMeterRegistry\u003c/code\u003e\u0026nbsp;in\u0026nbsp;\u003ccode\u003emicrometer-core\u003c/code\u003e, because metric output is printed line-by-line to log files, this allows for both metric spoofing (if downstream log-metrics scrapers or parsers ingest the log lines as separate metrics) and general log spoofing.\u003c/li\u003e\u003c/ul\u003e\u003cp\u003eSpecifically, an application is vulnerable when all the following are true:\u003c/p\u003e\u003cul\u003e\u003cli\u003eThe application uses a vulnerable version of\u0026nbsp;\u003ccode\u003eio.micrometer:micrometer-registry-statsd\u003c/code\u003e\u0026nbsp;or\u0026nbsp;\u003ccode\u003eio.micrometer:micrometer-core\u003c/code\u003e.\u003c/li\u003e\u003cli\u003eThe application uses the\u0026nbsp;\u003ccode\u003eDatadog\u003c/code\u003e\u0026nbsp;or\u0026nbsp;\u003ccode\u003eEtsy\u003c/code\u003e\u0026nbsp;flavor of the StatsD registry, or uses\u0026nbsp;\u003ccode\u003eLoggingMeterRegistry\u003c/code\u003e.\u003c/li\u003e\u003cli\u003eThe application instruments meters using user-controlled, unvalidated input for metric names, tag keys, or tag values.\u003c/li\u003e\u003c/ul\u003e\u003cp\u003eWhen vulnerable, an attacker can break out of the current metric or log line by injecting line terminators. This allows them to spoof arbitrary metrics (e.g., system load, standard JVM metrics, or other business metrics) across the metrics registry namespace (either directly via StatsD protocol or via downstream log-metric scrapers/parsers), as well as inject arbitrary log entries to spoof general log records.\u003c/p\u003e"
            }
          ],
          "value": "Using untrusted, non-normalized input as-is for metrics data (such as metric names, tag keys, or tag values) is a dangerous antipattern that general-purpose instrumentation should never perform. When such unsafe instrumentation is used, the application becomes vulnerable to injection and spoofing attacks because\u00a0micrometer-registry-statsd\u00a0and\u00a0micrometer-core\u00a0do not sanitize newline characters (\\n,\u00a0\\r) by default prior to this fix.\n\n  *  For the StatsD registry in\u00a0micrometer-registry-statsd\u00a0(when using the\u00a0Datadog\u00a0or\u00a0Etsy\u00a0flavor), because the StatsD protocol is newline-delimited, this allows for line-protocol injection (cross-metric spoofing).\n  *  For\u00a0LoggingMeterRegistry\u00a0in\u00a0micrometer-core, because metric output is printed line-by-line to log files, this allows for both metric spoofing (if downstream log-metrics scrapers or parsers ingest the log lines as separate metrics) and general log spoofing.\n\n\n\n\nSpecifically, an application is vulnerable when all the following are true:\n\n  *  The application uses a vulnerable version of\u00a0io.micrometer:micrometer-registry-statsd\u00a0or\u00a0io.micrometer:micrometer-core.\n  *  The application uses the\u00a0Datadog\u00a0or\u00a0Etsy\u00a0flavor of the StatsD registry, or uses\u00a0LoggingMeterRegistry.\n  *  The application instruments meters using user-controlled, unvalidated input for metric names, tag keys, or tag values.\n\n\n\n\nWhen vulnerable, an attacker can break out of the current metric or log line by injecting line terminators. This allows them to spoof arbitrary metrics (e.g., system load, standard JVM metrics, or other business metrics) across the metrics registry namespace (either directly via StatsD protocol or via downstream log-metric scrapers/parsers), as well as inject arbitrary log entries to spoof general log records."
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "attackComplexity": "HIGH",
            "attackVector": "NETWORK",
            "availabilityImpact": "NONE",
            "baseScore": 5.9,
            "baseSeverity": "MEDIUM",
            "confidentialityImpact": "NONE",
            "integrityImpact": "HIGH",
            "privilegesRequired": "NONE",
            "scope": "UNCHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:H/A:N",
            "version": "3.1"
          },
          "format": "CVSS",
          "scenarios": [
            {
              "lang": "en",
              "value": "GENERAL"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-08-21T10:47:25.384Z",
        "orgId": "dcf2e128-44bd-42ed-91e8-88f912c1401d",
        "shortName": "vmware"
      },
      "references": [
        {
          "url": "https://spring.io/security/cve-2026-59296"
        }
      ],
      "source": {
        "discovery": "UNKNOWN"
      },
      "title": "Micrometer StatsD and Logging meter registries line-protocol and log injection vulnerability",
      "x_generator": {
        "engine": "Vulnogram 1.0.4"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "dcf2e128-44bd-42ed-91e8-88f912c1401d",
    "assignerShortName": "vmware",
    "cveId": "CVE-2026-59296",
    "datePublished": "2026-08-21T10:47:25.384Z",
    "dateReserved": "2026-07-04T18:13:34.323Z",
    "dateUpdated": "2026-08-21T16:44:12.342Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2",
  "vulnerability-lookup:meta": {
    "epss": {
      "cve": "CVE-2026-59296",
      "date": "2026-08-22",
      "epss": "0.00197",
      "percentile": "0.09787"
    },
    "nvd": "{\"cve\":{\"id\":\"CVE-2026-59296\",\"sourceIdentifier\":\"security@vmware.com\",\"published\":\"2026-08-21T11:17:05.780\",\"lastModified\":\"2026-08-21T17:16:32.373\",\"vulnStatus\":\"Received\",\"cveTags\":[],\"descriptions\":[{\"lang\":\"en\",\"value\":\"Using untrusted, non-normalized input as-is for metrics data (such as metric names, tag keys, or tag values) is a dangerous antipattern that general-purpose instrumentation should never perform. When such unsafe instrumentation is used, the application becomes vulnerable to injection and spoofing attacks because\u00a0micrometer-registry-statsd\u00a0and\u00a0micrometer-core\u00a0do not sanitize newline characters (\\\\n,\u00a0\\\\r) by default prior to this fix.\\n\\n  *  For the StatsD registry in\u00a0micrometer-registry-statsd\u00a0(when using the\u00a0Datadog\u00a0or\u00a0Etsy\u00a0flavor), because the StatsD protocol is newline-delimited, this allows for line-protocol injection (cross-metric spoofing).\\n  *  For\u00a0LoggingMeterRegistry\u00a0in\u00a0micrometer-core, because metric output is printed line-by-line to log files, this allows for both metric spoofing (if downstream log-metrics scrapers or parsers ingest the log lines as separate metrics) and general log spoofing.\\n\\n\\n\\n\\nSpecifically, an application is vulnerable when all the following are true:\\n\\n  *  The application uses a vulnerable version of\u00a0io.micrometer:micrometer-registry-statsd\u00a0or\u00a0io.micrometer:micrometer-core.\\n  *  The application uses the\u00a0Datadog\u00a0or\u00a0Etsy\u00a0flavor of the StatsD registry, or uses\u00a0LoggingMeterRegistry.\\n  *  The application instruments meters using user-controlled, unvalidated input for metric names, tag keys, or tag values.\\n\\n\\n\\n\\nWhen vulnerable, an attacker can break out of the current metric or log line by injecting line terminators. This allows them to spoof arbitrary metrics (e.g., system load, standard JVM metrics, or other business metrics) across the metrics registry namespace (either directly via StatsD protocol or via downstream log-metric scrapers/parsers), as well as inject arbitrary log entries to spoof general log records.\"}],\"affected\":[{\"source\":\"security@vmware.com\",\"affectedData\":[{\"vendor\":\"VMware\",\"product\":\"Spring Micrometer\",\"defaultStatus\":\"affected\",\"versions\":[{\"version\":\"1.17.0 - 1.17.0\",\"status\":\"affected\"},{\"version\":\"1.16.0 - 1.16.6\",\"status\":\"affected\"},{\"version\":\"1.15.0 - 1.15.12\",\"status\":\"affected\"},{\"version\":\"1.14.0 - 1.14.16\",\"status\":\"affected\"},{\"version\":\"1.9.18 and earlier\",\"status\":\"affected\"},{\"version\":\"1.17.0.1\",\"versionType\":\"enterprise support only\",\"status\":\"unaffected\"},{\"version\":\"1.17.1\",\"versionType\":\"oss\",\"status\":\"unaffected\"},{\"version\":\"1.16.6.1\",\"versionType\":\"enterprise support only\",\"status\":\"unaffected\"},{\"version\":\"1.16.7\",\"versionType\":\"oss\",\"status\":\"unaffected\"},{\"version\":\"1.15.13\",\"versionType\":\"enterprise support only\",\"status\":\"unaffected\"},{\"version\":\"1.14.17\",\"versionType\":\"enterprise support only\",\"status\":\"unaffected\"},{\"version\":\"1.9.19\",\"versionType\":\"enterprise support only\",\"status\":\"unaffected\"}]}]}],\"metrics\":{\"cvssMetricV31\":[{\"source\":\"security@vmware.com\",\"type\":\"Secondary\",\"cvssData\":{\"version\":\"3.1\",\"vectorString\":\"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:H/A:N\",\"baseScore\":5.9,\"baseSeverity\":\"MEDIUM\",\"attackVector\":\"NETWORK\",\"attackComplexity\":\"HIGH\",\"privilegesRequired\":\"NONE\",\"userInteraction\":\"NONE\",\"scope\":\"UNCHANGED\",\"confidentialityImpact\":\"NONE\",\"integrityImpact\":\"HIGH\",\"availabilityImpact\":\"NONE\"},\"exploitabilityScore\":2.2,\"impactScore\":3.6}],\"ssvcV203\":[{\"source\":\"134c704f-9b21-4f2e-91b3-4a467353bcc0\",\"ssvcData\":{\"timestamp\":\"2026-08-21T11:55:29.457945Z\",\"id\":\"CVE-2026-59296\",\"options\":[{\"exploitation\":\"none\"},{\"automatable\":\"no\"},{\"technicalImpact\":\"partial\"}],\"role\":\"CISA Coordinator\",\"version\":\"2.0.3\"}}]},\"weaknesses\":[{\"source\":\"134c704f-9b21-4f2e-91b3-4a467353bcc0\",\"type\":\"Secondary\",\"description\":[{\"lang\":\"en\",\"value\":\"CWE-74\"}]}],\"references\":[{\"url\":\"https://spring.io/security/cve-2026-59296\",\"source\":\"security@vmware.com\"}]}}",
    "vulnrichment": {
      "containers": "{\"adp\": [{\"title\": \"CISA ADP Vulnrichment\", \"metrics\": [{\"other\": {\"type\": \"ssvc\", \"content\": {\"id\": \"CVE-2026-59296\", \"role\": \"CISA Coordinator\", \"options\": [{\"Exploitation\": \"none\"}, {\"Automatable\": \"no\"}, {\"Technical Impact\": \"partial\"}], \"version\": \"2.0.3\", \"timestamp\": \"2026-08-21T11:55:29.457945Z\"}}}], \"problemTypes\": [{\"descriptions\": [{\"lang\": \"en\", \"type\": \"CWE\", \"cweId\": \"CWE-74\", \"description\": \"CWE-74 Improper Neutralization of Special Elements in Output Used by a Downstream Component (\u0027Injection\u0027)\"}]}], \"providerMetadata\": {\"orgId\": \"134c704f-9b21-4f2e-91b3-4a467353bcc0\", \"shortName\": \"CISA-ADP\", \"dateUpdated\": \"2026-08-21T11:55:35.874Z\"}}], \"cna\": {\"title\": \"Micrometer StatsD and Logging meter registries line-protocol and log injection vulnerability\", \"source\": {\"discovery\": \"UNKNOWN\"}, \"metrics\": [{\"format\": \"CVSS\", \"cvssV3_1\": {\"scope\": \"UNCHANGED\", \"version\": \"3.1\", \"baseScore\": 5.9, \"attackVector\": \"NETWORK\", \"baseSeverity\": \"MEDIUM\", \"vectorString\": \"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:H/A:N\", \"integrityImpact\": \"HIGH\", \"userInteraction\": \"NONE\", \"attackComplexity\": \"HIGH\", \"availabilityImpact\": \"NONE\", \"privilegesRequired\": \"NONE\", \"confidentialityImpact\": \"NONE\"}, \"scenarios\": [{\"lang\": \"en\", \"value\": \"GENERAL\"}]}], \"affected\": [{\"vendor\": \"VMware\", \"product\": \"Spring Micrometer\", \"versions\": [{\"status\": \"affected\", \"version\": \"1.17.0 - 1.17.0\"}, {\"status\": \"affected\", \"version\": \"1.16.0 - 1.16.6\"}, {\"status\": \"affected\", \"version\": \"1.15.0 - 1.15.12\"}, {\"status\": \"affected\", \"version\": \"1.14.0 - 1.14.16\"}, {\"status\": \"affected\", \"version\": \"1.9.18 and earlier\"}, {\"status\": \"unaffected\", \"version\": \"1.17.0.1\", \"versionType\": \"enterprise support only\"}, {\"status\": \"unaffected\", \"version\": \"1.17.1\", \"versionType\": \"oss\"}, {\"status\": \"unaffected\", \"version\": \"1.16.6.1\", \"versionType\": \"enterprise support only\"}, {\"status\": \"unaffected\", \"version\": \"1.16.7\", \"versionType\": \"oss\"}, {\"status\": \"unaffected\", \"version\": \"1.15.13\", \"versionType\": \"enterprise support only\"}, {\"status\": \"unaffected\", \"version\": \"1.14.17\", \"versionType\": \"enterprise support only\"}, {\"status\": \"unaffected\", \"version\": \"1.9.19\", \"versionType\": \"enterprise support only\"}], \"defaultStatus\": \"affected\"}], \"datePublic\": \"2026-08-20T10:42:00.000Z\", \"references\": [{\"url\": \"https://spring.io/security/cve-2026-59296\"}], \"x_generator\": {\"engine\": \"Vulnogram 1.0.4\"}, \"descriptions\": [{\"lang\": \"en\", \"value\": \"Using untrusted, non-normalized input as-is for metrics data (such as metric names, tag keys, or tag values) is a dangerous antipattern that general-purpose instrumentation should never perform. When such unsafe instrumentation is used, the application becomes vulnerable to injection and spoofing attacks because\\u00a0micrometer-registry-statsd\\u00a0and\\u00a0micrometer-core\\u00a0do not sanitize newline characters (\\\\n,\\u00a0\\\\r) by default prior to this fix.\\n\\n  *  For the StatsD registry in\\u00a0micrometer-registry-statsd\\u00a0(when using the\\u00a0Datadog\\u00a0or\\u00a0Etsy\\u00a0flavor), because the StatsD protocol is newline-delimited, this allows for line-protocol injection (cross-metric spoofing).\\n  *  For\\u00a0LoggingMeterRegistry\\u00a0in\\u00a0micrometer-core, because metric output is printed line-by-line to log files, this allows for both metric spoofing (if downstream log-metrics scrapers or parsers ingest the log lines as separate metrics) and general log spoofing.\\n\\n\\n\\n\\nSpecifically, an application is vulnerable when all the following are true:\\n\\n  *  The application uses a vulnerable version of\\u00a0io.micrometer:micrometer-registry-statsd\\u00a0or\\u00a0io.micrometer:micrometer-core.\\n  *  The application uses the\\u00a0Datadog\\u00a0or\\u00a0Etsy\\u00a0flavor of the StatsD registry, or uses\\u00a0LoggingMeterRegistry.\\n  *  The application instruments meters using user-controlled, unvalidated input for metric names, tag keys, or tag values.\\n\\n\\n\\n\\nWhen vulnerable, an attacker can break out of the current metric or log line by injecting line terminators. This allows them to spoof arbitrary metrics (e.g., system load, standard JVM metrics, or other business metrics) across the metrics registry namespace (either directly via StatsD protocol or via downstream log-metric scrapers/parsers), as well as inject arbitrary log entries to spoof general log records.\", \"supportingMedia\": [{\"type\": \"text/html\", \"value\": \"\u003cp\u003eUsing untrusted, non-normalized input as-is for metrics data (such as metric names, tag keys, or tag values) is a dangerous antipattern that general-purpose instrumentation should never perform. When such unsafe instrumentation is used, the application becomes vulnerable to injection and spoofing attacks because\u0026nbsp;\u003ccode\u003emicrometer-registry-statsd\u003c/code\u003e\u0026nbsp;and\u0026nbsp;\u003ccode\u003emicrometer-core\u003c/code\u003e\u0026nbsp;do not sanitize newline characters (\u003ccode\u003e\\\\n\u003c/code\u003e,\u0026nbsp;\u003ccode\u003e\\\\r\u003c/code\u003e) by default prior to this fix.\u003c/p\u003e\u003cul\u003e\u003cli\u003eFor the StatsD registry in\u0026nbsp;\u003ccode\u003emicrometer-registry-statsd\u003c/code\u003e\u0026nbsp;(when using the\u0026nbsp;\u003ccode\u003eDatadog\u003c/code\u003e\u0026nbsp;or\u0026nbsp;\u003ccode\u003eEtsy\u003c/code\u003e\u0026nbsp;flavor), because the StatsD protocol is newline-delimited, this allows for line-protocol injection (cross-metric spoofing).\u003c/li\u003e\u003cli\u003eFor\u0026nbsp;\u003ccode\u003eLoggingMeterRegistry\u003c/code\u003e\u0026nbsp;in\u0026nbsp;\u003ccode\u003emicrometer-core\u003c/code\u003e, because metric output is printed line-by-line to log files, this allows for both metric spoofing (if downstream log-metrics scrapers or parsers ingest the log lines as separate metrics) and general log spoofing.\u003c/li\u003e\u003c/ul\u003e\u003cp\u003eSpecifically, an application is vulnerable when all the following are true:\u003c/p\u003e\u003cul\u003e\u003cli\u003eThe application uses a vulnerable version of\u0026nbsp;\u003ccode\u003eio.micrometer:micrometer-registry-statsd\u003c/code\u003e\u0026nbsp;or\u0026nbsp;\u003ccode\u003eio.micrometer:micrometer-core\u003c/code\u003e.\u003c/li\u003e\u003cli\u003eThe application uses the\u0026nbsp;\u003ccode\u003eDatadog\u003c/code\u003e\u0026nbsp;or\u0026nbsp;\u003ccode\u003eEtsy\u003c/code\u003e\u0026nbsp;flavor of the StatsD registry, or uses\u0026nbsp;\u003ccode\u003eLoggingMeterRegistry\u003c/code\u003e.\u003c/li\u003e\u003cli\u003eThe application instruments meters using user-controlled, unvalidated input for metric names, tag keys, or tag values.\u003c/li\u003e\u003c/ul\u003e\u003cp\u003eWhen vulnerable, an attacker can break out of the current metric or log line by injecting line terminators. This allows them to spoof arbitrary metrics (e.g., system load, standard JVM metrics, or other business metrics) across the metrics registry namespace (either directly via StatsD protocol or via downstream log-metric scrapers/parsers), as well as inject arbitrary log entries to spoof general log records.\u003c/p\u003e\", \"base64\": false}]}], \"providerMetadata\": {\"orgId\": \"dcf2e128-44bd-42ed-91e8-88f912c1401d\", \"shortName\": \"vmware\", \"dateUpdated\": \"2026-08-21T10:47:25.384Z\"}}}",
      "cveMetadata": "{\"cveId\": \"CVE-2026-59296\", \"state\": \"PUBLISHED\", \"dateUpdated\": \"2026-08-21T16:44:12.342Z\", \"dateReserved\": \"2026-07-04T18:13:34.323Z\", \"assignerOrgId\": \"dcf2e128-44bd-42ed-91e8-88f912c1401d\", \"datePublished\": \"2026-08-21T10:47:25.384Z\", \"assignerShortName\": \"vmware\"}",
      "dataType": "CVE_RECORD",
      "dataVersion": "5.2"
    }
  }
}

FKIE_CVE-2026-59296

Vulnerability from fkie_nvd - Published: 2026-08-21 11:17 - Updated: 2026-08-21 17:16

Severity

5.9 (Medium) - CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:H/A:N

Summary

References

	URL	Tags
	security@vmware.com	https://spring.io/security/cve-2026-59296

Impacted products

	Vendor	Product	Version

JSON

To clipboard

{
  "affected": [
    {
      "affectedData": [
        {
          "defaultStatus": "affected",
          "product": "Spring Micrometer",
          "vendor": "VMware",
          "versions": [
            {
              "status": "affected",
              "version": "1.17.0 - 1.17.0"
            },
            {
              "status": "affected",
              "version": "1.16.0 - 1.16.6"
            },
            {
              "status": "affected",
              "version": "1.15.0 - 1.15.12"
            },
            {
              "status": "affected",
              "version": "1.14.0 - 1.14.16"
            },
            {
              "status": "affected",
              "version": "1.9.18 and earlier"
            },
            {
              "status": "unaffected",
              "version": "1.17.0.1",
              "versionType": "enterprise support only"
            },
            {
              "status": "unaffected",
              "version": "1.17.1",
              "versionType": "oss"
            },
            {
              "status": "unaffected",
              "version": "1.16.6.1",
              "versionType": "enterprise support only"
            },
            {
              "status": "unaffected",
              "version": "1.16.7",
              "versionType": "oss"
            },
            {
              "status": "unaffected",
              "version": "1.15.13",
              "versionType": "enterprise support only"
            },
            {
              "status": "unaffected",
              "version": "1.14.17",
              "versionType": "enterprise support only"
            },
            {
              "status": "unaffected",
              "version": "1.9.19",
              "versionType": "enterprise support only"
            }
          ]
        }
      ],
      "source": "security@vmware.com"
    }
  ],
  "cveTags": [],
  "descriptions": [
    {
      "lang": "en",
      "value": "Using untrusted, non-normalized input as-is for metrics data (such as metric names, tag keys, or tag values) is a dangerous antipattern that general-purpose instrumentation should never perform. When such unsafe instrumentation is used, the application becomes vulnerable to injection and spoofing attacks because\u00a0micrometer-registry-statsd\u00a0and\u00a0micrometer-core\u00a0do not sanitize newline characters (\\n,\u00a0\\r) by default prior to this fix.\n\n  *  For the StatsD registry in\u00a0micrometer-registry-statsd\u00a0(when using the\u00a0Datadog\u00a0or\u00a0Etsy\u00a0flavor), because the StatsD protocol is newline-delimited, this allows for line-protocol injection (cross-metric spoofing).\n  *  For\u00a0LoggingMeterRegistry\u00a0in\u00a0micrometer-core, because metric output is printed line-by-line to log files, this allows for both metric spoofing (if downstream log-metrics scrapers or parsers ingest the log lines as separate metrics) and general log spoofing.\n\n\n\n\nSpecifically, an application is vulnerable when all the following are true:\n\n  *  The application uses a vulnerable version of\u00a0io.micrometer:micrometer-registry-statsd\u00a0or\u00a0io.micrometer:micrometer-core.\n  *  The application uses the\u00a0Datadog\u00a0or\u00a0Etsy\u00a0flavor of the StatsD registry, or uses\u00a0LoggingMeterRegistry.\n  *  The application instruments meters using user-controlled, unvalidated input for metric names, tag keys, or tag values.\n\n\n\n\nWhen vulnerable, an attacker can break out of the current metric or log line by injecting line terminators. This allows them to spoof arbitrary metrics (e.g., system load, standard JVM metrics, or other business metrics) across the metrics registry namespace (either directly via StatsD protocol or via downstream log-metric scrapers/parsers), as well as inject arbitrary log entries to spoof general log records."
    }
  ],
  "id": "CVE-2026-59296",
  "lastModified": "2026-08-21T17:16:32.373",
  "metrics": {
    "cvssMetricV31": [
      {
        "cvssData": {
          "attackComplexity": "HIGH",
          "attackVector": "NETWORK",
          "availabilityImpact": "NONE",
          "baseScore": 5.9,
          "baseSeverity": "MEDIUM",
          "confidentialityImpact": "NONE",
          "integrityImpact": "HIGH",
          "privilegesRequired": "NONE",
          "scope": "UNCHANGED",
          "userInteraction": "NONE",
          "vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:H/A:N",
          "version": "3.1"
        },
        "exploitabilityScore": 2.2,
        "impactScore": 3.6,
        "source": "security@vmware.com",
        "type": "Secondary"
      }
    ],
    "ssvcV203": [
      {
        "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
        "ssvcData": {
          "id": "CVE-2026-59296",
          "options": [
            {
              "exploitation": "none"
            },
            {
              "automatable": "no"
            },
            {
              "technicalImpact": "partial"
            }
          ],
          "role": "CISA Coordinator",
          "timestamp": "2026-08-21T11:55:29.457945Z",
          "version": "2.0.3"
        }
      }
    ]
  },
  "published": "2026-08-21T11:17:05.780",
  "references": [
    {
      "source": "security@vmware.com",
      "url": "https://spring.io/security/cve-2026-59296"
    }
  ],
  "sourceIdentifier": "security@vmware.com",
  "vulnStatus": "Received",
  "weaknesses": [
    {
      "description": [
        {
          "lang": "en",
          "value": "CWE-74"
        }
      ],
      "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
      "type": "Secondary"
    }
  ]
}

GHSA-8JCV-3C3X-VWG4

Vulnerability from github – Published: 2026-08-21 12:30 – Updated: 2026-08-21 18:34

Details

For the StatsD registry in micrometer-registry-statsd (when using the Datadog or Etsy flavor), because the StatsD protocol is newline-delimited, this allows for line-protocol injection (cross-metric spoofing).
For LoggingMeterRegistry in micrometer-core, because metric output is printed line-by-line to log files, this allows for both metric spoofing (if downstream log-metrics scrapers or parsers ingest the log lines as separate metrics) and general log spoofing.

Specifically, an application is vulnerable when all the following are true:

The application uses a vulnerable version of io.micrometer:micrometer-registry-statsd or io.micrometer:micrometer-core.
The application uses the Datadog or Etsy flavor of the StatsD registry, or uses LoggingMeterRegistry.
The application instruments meters using user-controlled, unvalidated input for metric names, tag keys, or tag values.

When vulnerable, an attacker can break out of the current metric or log line by injecting line terminators. This allows them to spoof arbitrary metrics (e.g., system load, standard JVM metrics, or other business metrics) across the metrics registry namespace (either directly via StatsD protocol or via downstream log-metric scrapers/parsers), as well as inject arbitrary log entries to spoof general log records.

Severity

5.9 (Medium)


                  
                    CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:H/A:N

Show details on source website

JSON

To clipboard

{
  "affected": [],
  "aliases": [
    "CVE-2026-59296"
  ],
  "database_specific": {
    "cwe_ids": [
      "CWE-74"
    ],
    "github_reviewed": false,
    "github_reviewed_at": null,
    "nvd_published_at": "2026-08-21T11:17:05Z",
    "severity": "MODERATE"
  },
  "details": "Using untrusted, non-normalized input as-is for metrics data (such as metric names, tag keys, or tag values) is a dangerous antipattern that general-purpose instrumentation should never perform. When such unsafe instrumentation is used, the application becomes vulnerable to injection and spoofing attacks because\u00a0micrometer-registry-statsd\u00a0and\u00a0micrometer-core\u00a0do not sanitize newline characters (\\n,\u00a0\\r) by default prior to this fix.\n\n  *  For the StatsD registry in\u00a0micrometer-registry-statsd\u00a0(when using the\u00a0Datadog\u00a0or\u00a0Etsy\u00a0flavor), because the StatsD protocol is newline-delimited, this allows for line-protocol injection (cross-metric spoofing).\n  *  For\u00a0LoggingMeterRegistry\u00a0in\u00a0micrometer-core, because metric output is printed line-by-line to log files, this allows for both metric spoofing (if downstream log-metrics scrapers or parsers ingest the log lines as separate metrics) and general log spoofing.\n\n\n\n\nSpecifically, an application is vulnerable when all the following are true:\n\n  *  The application uses a vulnerable version of\u00a0io.micrometer:micrometer-registry-statsd\u00a0or\u00a0io.micrometer:micrometer-core.\n  *  The application uses the\u00a0Datadog\u00a0or\u00a0Etsy\u00a0flavor of the StatsD registry, or uses\u00a0LoggingMeterRegistry.\n  *  The application instruments meters using user-controlled, unvalidated input for metric names, tag keys, or tag values.\n\n\n\n\nWhen vulnerable, an attacker can break out of the current metric or log line by injecting line terminators. This allows them to spoof arbitrary metrics (e.g., system load, standard JVM metrics, or other business metrics) across the metrics registry namespace (either directly via StatsD protocol or via downstream log-metric scrapers/parsers), as well as inject arbitrary log entries to spoof general log records.",
  "id": "GHSA-8jcv-3c3x-vwg4",
  "modified": "2026-08-21T18:34:56Z",
  "published": "2026-08-21T12:30:32Z",
  "references": [
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-59296"
    },
    {
      "type": "WEB",
      "url": "https://spring.io/security/cve-2026-59296"
    }
  ],
  "schema_version": "1.4.0",
  "severity": [
    {
      "score": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:H/A:N",
      "type": "CVSS_V3"
    }
  ]
}

Sightings

Author	Source	Type	Date	Other

Nomenclature

Seen: The vulnerability was mentioned, discussed, or observed by the user.
Confirmed: The vulnerability has been validated from an analyst's perspective.
Published Proof of Concept: A public proof of concept is available for this vulnerability.
Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
Not confirmed: The user expressed doubt about the validity of the vulnerability.
Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.

Detection rules are retrieved from Rulezet.

The MITRE ATT&CK techniques below are AI-generated suggestions, inferred from the description of the vulnerability by the CIRCL/vulnerability-attack-technique-classification-roberta-base model, served locally by ML-Gateway. They have not been verified by an analyst and are provided for guidance only.
The approach is described in our paper Mapping CVEs to MITRE ATT&CK Techniques: A Curated Gold-Set Classifier and the Limits of LLM-Assisted Label Expansion.

Action not permitted

CVE-2026-59296 (GCVE-0-2026-59296)

FKIE_CVE-2026-59296

GHSA-8JCV-3C3X-VWG4

Tags

Sightings

Nomenclature