CVE-2026-59296: Micrometer StatsD and Logging meter registries line-protocol and log injection vulnerability
Using untrusted, non-normalized input as-is for metrics data (such as metric names, tag keys, or tag values) is a dangerous antipattern that general-purpose instrumentation should never perform. Micrometer 1.17.0 Micrometer 1.16.0 - 1.16.6 Micrometer 1.15.0 - 1.15.12 Micrometer 1.14.0 - 1.14.16 Micrometer 1.9.18 and earlier
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Configuration
Ensure the application does not pass untrusted metric names/tag keys/tag values directly to Micrometer; normalize/unvalidate inputs so newline characters (\n, \r) are not emitted into StatsD line protocol or log line output.
micrometer-registry-statsd (Datadog or Etsy flavor) / LoggingMeterRegistry metric/log line input sanitation (newline sanitization) = sanitize/remove line terminators (\n, \r) before emitting metric names, tag keys, or tag values
Event History
Frequently Asked Questions
Which deployments are affected?
Affected deployments use a vulnerable version of micrometer-registry-statsd with the Datadog or Etsy flavor, or use LoggingMeterRegistry from micrometer-core. Exploitation also requires unsafe instrumentation that passes untrusted, non-normalized data into metric names, tag keys, or tag values.
What must an attacker control to exploit this issue?
An attacker must be able to influence metric data that is used as a metric name, tag key, or tag value and have newline characters included in that data. Before the fix, newline characters are not sanitized by default.
What is the impact for each affected registry?
With the Datadog or Etsy StatsD flavors, newline-delimited protocol handling permits injected metric lines and cross-metric spoofing. With LoggingMeterRegistry, injected lines can spoof metrics for downstream log-metric parsers and can also spoof general log output.
What can be done before patching is available?
Do not use untrusted input directly as metric names, tag keys, or tag values. Normalize or reject newline characters in such input, and avoid unsafe instrumentation paths that allow externally influenced values to be emitted as metrics or log lines.