CVE-2026-59296CWE-74

CVE-2026-59296

Medium · published August 21, 2026

CVSS v3.1
5.9
EPSS
0%
Percentile
21.7
In the wild
Unconfirmed
What it is

Using untrusted, non-normalized input as-is for metrics data (such as metric names, tag keys, or tag values) is a dangerous antipattern that general-purpose instrumentation should never perform.

Micrometer 1.17.0

Micrometer 1.16.0 - 1.16.6

Micrometer 1.15.0 - 1.15.12

Micrometer 1.14.0 - 1.14.16

Micrometer 1.9.18 and earlier

The record
Technical detail
CVSS v3.1
5.9 · MEDIUM
Vector
CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:H/A:N
CVSS v4.0
Not supplied
EPSS
0.00301 · 21.7th percentile
Weakness
CWE-74 · Improper Neutralization of Special Elements in Output Used by a Downstream Component ('Injection')
Published
2026-08-21T15:17Z
References (1)
https://spring.io/security/cve-2026-59296 · [email protected]
EPSS history
Timeline
  • 21 AUG 10:47Z
    Micrometer StatsD and Logging meter registries line-protocol and log injection vulnerability
    cvelistv5