Copyright © 2012 Red Hat, Inc. All rights reserved. Moderate 2026-08-21T10:47:25 io.micrometer/micrometer-registry-statsd: io.micrometer/micrometer-core: Micrometer: Line-protocol and log injection via unsanitized input allows metric and log spoofing 5.9 CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:H/A:N CWE-93

Using untrusted, non-normalized input as-is for metrics data (such as metric names, tag keys, or tag values) is a dangerous antipattern that general-purpose instrumentation should never perform. When such unsafe instrumentation is used, the application becomes vulnerable to injection and spoofing attacks because micrometer-registry-statsd and micrometer-core do not sanitize newline characters (\n, \r) by default prior to this fix. * For the StatsD registry in micrometer-registry-statsd (when using the Datadog or Etsy flavor), because the StatsD protocol is newline-delimited, this allows for line-protocol injection (cross-metric spoofing). * For LoggingMeterRegistry in micrometer-core, because metric output is printed line-by-line to log files, this allows for both metric spoofing (if downstream log-metrics scrapers or parsers ingest the log lines as separate metrics) and general log spoofing. Specifically, an application is vulnerable when all the following are true: * The application uses a vulnerable version of io.micrometer:micrometer-registry-statsd or io.micrometer:micrometer-core. * The application uses the Datadog or Etsy flavor of the StatsD registry, or uses LoggingMeterRegistry. * The application instruments meters using user-controlled, unvalidated input for metric names, tag keys, or tag values. When vulnerable, an attacker can break out of the current metric or log line by injecting line terminators. This allows them to spoof arbitrary metrics (e.g., system load, standard JVM metrics, or other business metrics) across the metrics registry namespace (either directly via StatsD protocol or via downstream log-metric scrapers/parsers), as well as inject arbitrary log entries to spoof general log records.

A flaw was found in Micrometer's StatsD and Logging meter registries. This vulnerability allows a remote attacker to inject line terminators into metric data, such as names or tag values, due to insufficient sanitization of untrusted input. Exploitation can lead to the spoofing of arbitrary metrics, including critical system or business metrics, and the injection of false log entries, potentially impacting monitoring and auditing systems.

Red Hat OpenShift Dev Spaces 3.30 2026-09-01T00:00:00Z RHSA-2026:62260 devspaces/openvsx-rhel9:1787759145 Red Hat OpenShift Dev Spaces 3.30 2026-09-01T00:00:00Z RHSA-2026:62260 devspaces/pluginregistry-rhel9:1787759723 Exploit Intelligence Out of support scope exploit-intelligence/agent-client-rhel9 Red Hat AMQ Broker 7 Affected micrometer-core Red Hat build of Apache Camel 4 for Quarkus 3 Affected micrometer-core Red Hat build of Apache Camel for Spring Boot 4 Affected micrometer-core Red Hat build of Apicurio Registry 3 Out of support scope micrometer-core Red Hat build of Debezium 3 Affected micrometer-core Red Hat Build of Keycloak Affected keycloak/rhbk-openshift-rhel9 Red Hat Build of Keycloak Affected keycloak/rhbk-rhel9-operator Red Hat Build of Keycloak Affected micrometer-core Red Hat Build of Keycloak Affected rhbk/keycloak-rhel9 Red Hat Build of Keycloak Out of support scope rhbk/keycloak-rhel9-operator Red Hat build of Quarkus Affected micrometer-core Red Hat Data Grid 8 Out of support scope micrometer-core Red Hat Fuse 7 Out of support scope micrometer-core Red Hat JBoss Enterprise Application Platform 8 Not affected micrometer-core Red Hat JBoss Enterprise Application Platform Expansion Pack Affected micrometer-core Red Hat OpenShift AI (RHOAI) Affected rhoai/odh-trustyai-service-rhel9 Red Hat OpenShift Dev Spaces Affected devspaces/server-rhel9 Red Hat Satellite 6 Not affected candlepin Red Hat Satellite 6 Not affected satellite:el8/candlepin https://www.cve.org/CVERecord?id=CVE-2026-59296 https://nvd.nist.gov/vuln/detail/CVE-2026-59296 https://spring.io/security/cve-2026-59296