The vulnerability arises from unsafe instrumentation practices where untrusted input is used as-is for metrics data in VMware Spring Micrometer components micrometer-registry-statsd and micrometer-core. Specifically, newline characters (\n, \r) are not sanitized, allowing attackers to inject line terminators into metric names, tag keys, or tag values. For the StatsD registry (Datadog or Etsy flavors), this enables line-protocol injection leading to cross-metric spoofing. For LoggingMeterRegistry, it enables metric spoofing and general log spoofing by injecting arbitrary log entries. The vulnerability requires that the application uses a vulnerable version of the affected libraries, uses the specified registry flavors, and instruments meters with user-controlled, unvalidated input. No official remediation or patch is currently documented.

An attacker can inject newline characters into metrics or logs, allowing them to spoof arbitrary metrics or log entries. This can mislead monitoring systems by falsifying system or business metrics and corrupt log data integrity. The vulnerability does not impact confidentiality or availability but impacts the integrity of metrics and logs.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until a fix is available, avoid using untrusted or user-controlled input directly in metric names, tag keys, or tag values. Sanitize or normalize all input used for instrumentation to remove newline characters and other control characters that could enable injection. Review application instrumentation practices to ensure safe handling of metrics data.