CVE-2026-59296: CWE-117 Improper Output Neutralization for Logs in Spring Micrometer

This vulnerability in Spring Micrometer (CVE-2026-59296) concerns improper output neutralization for logs (CWE-117). The issue occurs because untrusted, non-normalized input is used as-is for metrics data, including metric names, tag keys, or tag values. This practice is considered a dangerous antipattern in instrumentation libraries and can lead to injection or log manipulation risks. The vulnerability affects multiple versions of Micrometer, specifically 1.17.0, 1.16.0 to 1.16.6, 1.15.0 to 1.15.12, 1.14.0 to 1.14.16, and all versions up to 1.9.18. The CVSS v3.1 score is 5.9, indicating medium severity, with a vector showing network attack vector, high attack complexity, no privileges required, no user interaction, unchanged scope, no confidentiality impact, high integrity impact, and no availability impact. There is no vendor advisory or patch link provided, and no known exploits in the wild.

The vulnerability allows an attacker to influence metrics data with untrusted input that is not properly neutralized before logging. This can lead to integrity issues in logs or monitoring systems, potentially enabling log injection or manipulation attacks. There is no confidentiality or availability impact reported. The medium CVSS score reflects the integrity impact without confidentiality or availability loss.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until a fix is available, users should avoid using untrusted or non-normalized input directly in metrics data such as metric names, tag keys, or tag values. Implement input validation or sanitization before passing data to Micrometer metrics to reduce risk.