Technical impact
Using untrusted, non‑normalized input as‑is for metrics data—such as metric names, tag keys, or tag values—is a dangerous antipattern that general‑purpose instrumentation should never perform. In Micrometer, when such input is passed freely, newline or carriage‑return characters can be injected into the StatsD line protocol or log output. This allows an attacker to break expected line boundaries, creating forged metric definitions or arbitrary log lines that can be interpreted as legitimate by downstream collectors, dashboards, or alerting systems. The vulnerability affects Micrometer releases 1.17.0, 1.16.0–1.16.6, 1.15.0–1.15.12, 1.14.0–1.14.16, and any version 1.9.18 or earlier.
Affected Systems
The vulnerability targets Spring Micrometer products, specifically the micrometer‑registry‑statsd and micrometer‑core libraries. All releases that lack newline sanitization are affected. Applications that employ the Datadog or Etsy flavors of the StatsD registry or the LoggingMeterRegistry and use user‑controlled data for metric names, tag keys, or tag values are directly at risk.
Risk and Exploitability
The CVSS score of 5.9 places the flaw in the medium‑severity range. The EPSS score of < 1% indicates a very low exploitation probability, and the vulnerability is not listed in the CISA KEV catalog. The likely attack vector, inferred from the CVE title and CWE identifiers, involves the injection of newline or carriage‑return characters into metric names, tag keys, or tag values supplied by an attacker. This can subvert metric namespaces or log content, resulting in misleading dashboards, false alarms, or cover‑up of malicious actions.
