CVE-2026-59296

A moderate severity flaw was found in Micrometer's StatsD and Logging meter registries (io.micrometer:micrometer-registry-statsd and io.micrometer:micrometer-core), which are shipped in a number of Red Hat middleware, integration, and application-platform products. These libraries do not sanitize newline characters (\n, \r) by default. When an application instruments meters using user-controlled, unvalidated input for metric names, tag keys, or tag values, a remote attacker can inject line terminators to break out of the current metric or log line. With the Datadog or Etsy flavor of the StatsD registry, whose protocol is newline-delimited, this enables line-protocol injection and cross-metric spoofing; with LoggingMeterRegistry, which prints metric output line-by-line to log files, this enables metric spoofing via downstream log-metrics scrapers or parsers as well as general log spoofing. A successful attacker can spoof arbitrary metrics, including critical system or business metrics, and inject false log entries, impacting the integrity of monitoring and auditing systems; the confidentiality and availability of the application itself are not directly affected. Exploitation requires the specific registry configuration together with unsafe instrumentation that passes untrusted input to meters, so attack complexity is high, and Red Hat rates this flaw Moderate (CVSS 3.1: 5.9, AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:H/A:N), consistent with the upstream MEDIUM rating.

Multiple Red Hat products that ship the affected components, including Red Hat build of Quarkus, JBoss EAP XP, Red Hat Build of Keycloak, JBoss Data Grid, Red Hat AMQ, Red Hat OpenShift AI, and Red Hat build of Apache Camel, are recorded as affected, and fixes are being pursued by the responsible engineering teams; several affected product streams are out of active support scope. Red Hat Satellite is not affected because the vulnerable code is not present in the shipped candlepin component.