CVE-2026-59296

Overview

Micrometer is a vendor-neutral application metrics facade for the JVM: instrumentation code records timers, counters and gauges against a MeterRegistry, and a registry implementation exports them to a monitoring backend. The micrometer-core module is that facade and the instrumentation itself, and it also ships LoggingMeterRegistry, which prints each meter to the application log one line at a time. The micrometer-registry-statsd module binds the facade to a StatsD backend, serializing every meter into a line of the newline-delimited StatsD protocol.

A Content Spoofing vulnerability (CVE-2026-59296) has been identified in the Datadog and Etsy StatsD line builders and in LoggingMeterRegistry, which allows attackers to terminate the current metrics line or log line with an injected carriage return or line feed and append fabricated metrics or log records of their own.

Per OWASP: "Content spoofing, also referred to as content injection, 'arbitrary text injection' or virtual defacement, is an attack targeting a user made possible by an injection vulnerability in a web application. When an application does not properly handle user-supplied data, an attacker can supply content to a web application, typically via a parameter value, that is reflected back to the user."

This issue affects the Datadog and Etsy StatsD flavors and the logging meter registry of Micrometer.

Details

Module Info

• Product: Micrometer
• Affected packages: io.micrometer:micrometer-core, io.micrometer:micrometer-registry-statsd
• Affected versions:
• io.micrometer:micrometer-core: <=1.9.18, >=1.10.0 <=1.14.16, >=1.15.0 <=1.15.12, >=1.16.0 <=1.16.6, 1.17.0
• io.micrometer:micrometer-registry-statsd: <=1.9.18, >=1.10.0 <=1.14.16, >=1.15.0 <=1.15.12, >=1.16.0 <=1.16.6, 1.17.0
• GitHub repository: https://github.com/micrometer-metrics/micrometer
• Published packages:
• https://central.sonatype.com/artifact/io.micrometer/micrometer-core
• https://central.sonatype.com/artifact/io.micrometer/micrometer-registry-statsd
• Package manager: Maven
• Fixed in: NES for Micrometer
• NES for Micrometer: 1.9.17-micrometer-1.9.19, 1.15.12-micrometer-1.15.14
• OSS Micrometer: 1.16.7, 1.17.1

Vulnerability Info

This Medium-severity vulnerability is found in the io.micrometer:micrometer-core and io.micrometer:micrometer-registry-statsd packages in the StatsD and logging meter registries of Micrometer.

Both StatsD flavors that use a colon as a field separator sanitize that one character and nothing else. In DatadogStatsdLineBuilder, meter names, tag keys and tag values are passed through the following helpers before they are concatenated into a line:

private String sanitizeName(String value) {
    if (!Character.isLetter(value.charAt(0))) {
        value = "m." + value;
    }
    return value.replace(':', '_');
}

private String sanitizeTagValue(String value) {
    return (value.charAt(value.length() - 1) == ':') ? value.substring(0, value.length() - 1) + '_' : value;
}

EtsyStatsdLineBuilder performs the same partial sanitization on the hierarchical name it builds for each meter:

private String etsyName(@Nullable Statistic stat) {
    return nameMapper.toHierarchicalName(stat != null ? id.withTag(stat) : id, config.namingConvention())
        .replace(':', '_');
}

Because the StatsD protocol is newline-delimited, a carriage return or line feed that survives these helpers ends the current datagram line and starts a new one. An application that instruments meters with unvalidated user input, for example by using a request path, a header value or a tenant identifier as a meter name or tag value, lets that input reach the backend as an additional, entirely attacker-chosen metric: system load, JVM metrics or business metrics can all be forged in the registry namespace.

The same omission exists on the core side. LoggingMeterRegistry renders each meter through an inner Printer class whose id() method returns the rendered identifier unchanged:

class Printer {

    private final Meter meter;

    Printer(Meter meter) {
        this.meter = meter;
    }

    String id() {
        return meterIdPrinter.apply(meter);
    }

    // remaining rendering helpers omitted
}

Since the registry writes one meter per log line, injected line terminators split a single meter into several log lines. That forges general log records and, where log-based metric scrapers parse those lines, forges metrics downstream as well. No sanitization of carriage return or line feed characters is applied at any point on either path, so the rendered identifier reaches the output verbatim.

This vulnerability was introduced in 2018 with Micrometer 1.0.0.

Mitigation

The affected 1.9.x and 1.15.x release lines are End-of-Life and will not receive community updates addressing this issue.

Users of the affected components should apply one of the following mitigations:

• Upgrade Micrometer to a currently supported release containing the fix.
• Leverage a commercial support partner like HeroDevs for post-EOL security support.

Credits

• Biswajeet Ray (finder)
• Nguyen Van Hiep from MBBank (finder)
• Yu Bao from PayPal Cyber Security Team (finder)