CVE-2026-59296

Name of the Vulnerable Software and Affected Versions io.micrometer:micrometer-registry-statsd (affected versions not specified) io.micrometer:micrometer-core (affected versions not specified)

Description Failure to sanitize newline characters ( , r) in metrics data allows for injection and spoofing attacks when untrusted, non-normalized input is used for metric names, tag keys, or tag values. In the StatsD registry (specifically Datadog or Etsy flavors), the newline-delimited nature of the protocol enables line-protocol injection, allowing attackers to spoof arbitrary metrics across the registry namespace. In the LoggingMeterRegistry function, where output is printed line-by-line, this allows for general log spoofing and metric spoofing if downstream scrapers or parsers treat log lines as separate metrics. Attackers can inject line terminators to break out of the current metric or log line and spoof system load, JVM metrics, or business metrics.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.