Improper Output Neutralization for Logs in Micrometer - CVE-2026-59296
Published: August 31, 2026
Vulnerability identifier: #VU146387
CSH Severity: Medium
CVSS v4: 8.2 [CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:H/VA:N/SC:N/SI:N/SA:N]
CVE-ID: CVE-2026-59296
CWE-ID: CWE-117
Exploitation vector: Remote access
Exploit availability:
No public exploit available
Vulnerability details
The vulnerability allows a remote attacker to spoof arbitrary metrics and inject arbitrary log entries.
The vulnerability exists due to improper neutralization of carriage return and line feed characters in StatsD meter registries and LoggingMeterRegistry when processing user-controlled metric names, tag keys, or tag values. A remote attacker can inject line terminators to spoof arbitrary metrics and inject arbitrary log entries.
The StatsD impact applies when using the Datadog or Etsy flavor, and the logging impact applies when downstream log scrapers or parsers ingest log lines as separate metrics.
Affected software
Micrometer
How to mitigate CVE-2026-59296
Install security update from vendor's website.
Micrometer - addressed in versions 1.9.19, 1.14.17, 1.15.13, 1.16.6.1, 1.16.7, 1.17.0.1, 1.17.1