Executive brief
Micrometer is a popular instrumentation library used by Spring applications to collect and export performance metrics. The vulnerability allows untrusted input (metric names, tag keys, or tag values) to be used directly without proper validation or normalization, potentially leading to injection attacks or malformed metric data that could disrupt monitoring systems or expose sensitive information.
Technical details
The vulnerability is an input validation flaw in Micrometer's metrics instrumentation where untrusted input (such as metric names, tag keys, or tag values) is processed as-is without normalization or sanitization. This antipattern allows attackers to inject malicious values that could be used to manipulate metric tags, forge metrics, or inject special characters that break metric parsing in downstream systems. The attack is network-reachable and requires no authentication if the application exposes metrics endpoints or accepts untrusted input that is passed to Micrometer. Patches are available for all affected versions (1.14.x, 1.15.x, 1.16.x, and newer versions should normalize input before use).
Affected products
- Spring Micrometer 1.9.18 and earlier, 1.14.0-1.14.16, 1.15.0-1.15.12, 1.16.0-1.16.6, 1.17.0
Timeline
- 2026-08-21: disclosed