CVE-2026-59296 Security Details

CVE ID

CVE-2026-59296

CWE

CWE-74

CVE Description

Using untrusted, non-normalized input as-is for metrics data (such as metric names, tag keys, or tag values) is a dangerous antipattern that general-purpose instrumentation should never perform. Micrometer 1.17.0 Micrometer 1.16.0 - 1.16.6 Micrometer 1.15.0 - 1.15.12 Micrometer 1.14.0 - 1.14.16 Micrometer 1.9.18 and earlier

Published

Aug 21, 2026

CVSS Score & Severity

6.3Medium

CVSS Vector

CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N

EPSS Score

0.301%

Malware

malware

KEV Status

Not in KEV Catalog: No known exploits

Vulnerable Methods

io/micrometer/core/instrument/logging/LoggingMeterRegistry$Printer.id()Ljava/lang/String;

JVM

io/micrometer/statsd/StatsdLineBuilder.<init>(Lio/micrometer/core/instrument/Meter$Id;Lio/micrometer/statsd/StatsdFlavor;Lio/micrometer/core/instrument/util/HierarchicalNameMapper;Lio/micrometer/core/instrument/MeterRegistry$Config;)V

JVMVulnerable params: 0

io/micrometer/statsd/StatsdLineBuilder.metricName(Lio/micrometer/core/instrument/Statistic;)Ljava/lang/String;

JVMVulnerable params: 0

io/micrometer/statsd/internal/DatadogStatsdLineBuilder.sanitizeName(Ljava/lang/String;)Ljava/lang/String;

JVMVulnerable params: 0

io/micrometer/statsd/internal/DatadogStatsdLineBuilder.sanitizeTagValue(Ljava/lang/String;)Ljava/lang/String;

JVMVulnerable params: 0

io/micrometer/statsd/internal/EtsyStatsdLineBuilder.etsyName(Lio/micrometer/core/instrument/Statistic;)Ljava/lang/String;

JVMVulnerable params: 0

io/micrometer/statsd/internal/FlavorStatsdLineBuilder.<init>(Lio/micrometer/core/instrument/Meter$Id;Lio/micrometer/statsd/StatsdFlavor;Lio/micrometer/core/instrument/util/HierarchicalNameMapper;Lio/micrometer/core/instrument/MeterRegistry$Config;)V

JVMVulnerable params: 0

io/micrometer/statsd/internal/FlavorStatsdLineBuilder.metricName(Lio/micrometer/core/instrument/Statistic;)Ljava/lang/String;

JVMVulnerable params: 0

Affected Ecosystems

affected

Source

National Vulnerability Database

References

spring.ioPROJECT