CVE-2026-59296

Awaiting Analysis Awaiting Analysis - Queue

StatsD Protocol Injection in Micrometer StatsD Registry

Publication date: 2026-08-21

Last updated on: 2026-08-27

Assigner: VMware

Description

Using untrusted, non-normalized input as-is for metrics data (such as metric names, tag keys, or tag values) is a dangerous antipattern that general-purpose instrumentation should never perform. Micrometer 1.17.0 Micrometer 1.16.0 - 1.16.6 Micrometer 1.15.0 - 1.15.12 Micrometer 1.14.0 - 1.14.16 Micrometer 1.9.18 and earlier

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-08-21

Last Modified

2026-08-27

Generated

2026-09-10

AI Q&A

2026-08-21

EPSS Evaluated

2026-09-09

NVD

CVE-2026-59296

EUVD

EUVD-2026-63885

Affected Vendors & Products

Vendor	Product	Version / Range
micrometer	micrometer-registry-statsd	From 1.14.0 (inc) to 1.17.0 (inc)
micrometer	micrometer-core	From 1.14.0 (inc) to 1.17.0 (inc)

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-74	The product constructs all or part of a command, data structure, or record using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify how it is parsed or interpreted when it is sent to a downstream component.

Attack-Flow Graph

Executive Summary

CVE-2026-59296 is a vulnerability in Micrometer's StatsD and Logging meter registries where untrusted input for metric names, tag keys, or tag values is not sanitized. This allows attackers to inject newline characters, enabling metric spoofing or log manipulation. The issue affects applications using vulnerable versions of micrometer-registry-statsd (Datadog or Etsy flavors) or micrometer-core (LoggingMeterRegistry).

Detection Guidance

Check if your application uses vulnerable versions of micrometer-registry-statsd (Datadog or Etsy flavors) or micrometer-core with LoggingMeterRegistry. Inspect metric names, tag keys, or tag values for newline characters in logs or StatsD output. Use commands like grep to search for newline characters in application logs or metrics output.

Impact Analysis

An attacker could spoof arbitrary metrics by injecting line terminators, affecting metrics like system load or business metrics. For LoggingMeterRegistry, they could inject fake log entries. Exploitation requires user-controlled, unvalidated input for metrics or logs.

Compliance Impact

This vulnerability could impact compliance with GDPR and HIPAA by enabling log spoofing and metric injection. Attackers could manipulate log entries to falsify records, potentially violating audit requirements under HIPAA for accurate logging. For GDPR, injected metrics or logs might expose or alter sensitive data processing information, undermining accountability and data integrity principles.

Mitigation Strategies

Upgrade to the latest fixed versions of Micrometer (e.g., 1.17.1, 1.16.7, or 1.15.13). Avoid using user-controlled input for metric names, tag keys, or tag values without validation. Sanitize all inputs to remove newline characters before processing.

Hi! I’m here to help you understand CVE-2026-59296. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70