CVE-2026-59296 Micrometer StatsD and Logging meter registries line-protocol and log injection vulnerability
Attackers can inject malicious content into metrics or logs via unnormalized input, potentially corrupting data or misleading monitoring systems.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2026-59296?
CVE-2026-59296 is a medium-severity vulnerability in Spring Micrometer, published on 21 Aug 2026. An attacker can exploit it over the internet without logging in, with no action from the victim.
Official description
Using untrusted, non-normalized input as-is for metrics data (such as metric names, tag keys, or tag values) is a dangerous antipattern that general-purpose instrumentation should never perform. Micrometer 1.17.0 Micrometer 1.16.0 - 1.16.6 Micrometer 1.15.0 - 1.15.12 Micrometer 1.14.0 - 1.14.16 Micrometer 1.9.18 and earlier
Weakness: CWE-74
Which versions are affected by CVE-2026-59296?
How do I fix CVE-2026-59296?
Upgrade to a fixed version.
Is CVE-2026-59296 being exploited?
There is no known exploitation of CVE-2026-59296 in the wild and no public exploit code.
Sources
Also known as CLEANSTART-2026-AS15122, CLEANSTART-2026-DL27432, CLEANSTART-2026-GB94492, CLEANSTART-2026-OZ28638, CLEANSTART-2026-RM52216, GHSA-8jcv-3c3x-vwg4.