Untrusted, unnormalized inputs are incorporated directly into metric names, tag keys, or tag values by micrometer-registry-statsd and micrometer-core, allowing attackers to insert newline or carriage return characters. These injected characters break the line boundary in the StatsD protocol or in log output, enabling attackers to inject arbitrary metric definitions or log entries that appear legitimate to downstream collectors or log scrapers. The impact is unintended metric spoofing across the registry namespace and the creation of malformed or deceptive log lines that may conceal malicious activity.

The vulnerability affects VMware:Spring Micrometer components, specifically micrometer-registry-statsd and micrometer-core. All versions of these libraries that do not perform newline sanitization are impacted. Applications that use the Datadog or Etsy flavors of the StatsD registry or the LoggingMeterRegistry with user-controlled metric input are directly at risk.

With a CVSS score of 5.9, the flaw is considered medium severity. EPSS data is not available, and the vulnerability is not listed in CISA KEV. The likely attack vector involves supplying crafted metric names or tags via interfaces that instrument metrics, such as web endpoints or configuration files. Once an attacker injects newline characters, they can forge metrics like system load or enterprise metrics, or inject arbitrary log entries, potentially leading to misleading monitoring dashboards or log-based alarm systems.