SB2026083151 - Multiple vulnerabilities in Micrometer

Description

This security bulletin contains information about 2 vulnerabilities.

1) Memory leak (CVE-ID: CVE-2026-59295)

CWE-ID: CWE-401 - Missing release of memory after effective lifetime

CVSSv4: 8.2 [CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a remote attacker to cause a denial of service.

The vulnerability exists due to an unbounded memory leak in MicrometerHttpClientInterceptor when handling outbound asynchronous HTTP requests that fail before any response message is received. A remote attacker can cause pre-response transport failures to cause a denial of service.

Exploitation requires a Micrometer-instrumented Apache HttpAsyncClient and outbound requests to a hostile or unreliable remote endpoint, or requests that can be subjected to pre-response transport failures.

2) Improper Output Neutralization for Logs (CVE-ID: CVE-2026-59296)

CWE-ID: CWE-117 - Improper Output Neutralization for Logs

CVSSv4: 8.2 [CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:H/VA:N/SC:N/SI:N/SA:N]

The vulnerability allows a remote attacker to spoof arbitrary metrics and inject arbitrary log entries.

The vulnerability exists due to improper neutralization of carriage return and line feed characters in StatsD meter registries and LoggingMeterRegistry when processing user-controlled metric names, tag keys, or tag values. A remote attacker can inject line terminators to spoof arbitrary metrics and inject arbitrary log entries.

The StatsD impact applies when using the Datadog or Etsy flavor, and the logging impact applies when downstream log scrapers or parsers ingest log lines as separate metrics.

Remediation

Install update from vendor's website.

References

• https://spring.io/security/cve-2026-59295
• https://spring.io/security/cve-2026-59296