CVE-2026-59296

{"dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": {"cveId": "CVE-2026-59296", "assignerOrgId": "dcf2e128-44bd-42ed-91e8-88f912c1401d", "state": "PUBLISHED", "assignerShortName": "vmware", "dateReserved": "2026-07-04T18:13:34.323Z", "datePublished": "2026-08-21T10:47:25.384Z", "dateUpdated": "2026-08-27T17:57:53.054Z"}, "containers": {"cna": {"providerMetadata": {"orgId": "dcf2e128-44bd-42ed-91e8-88f912c1401d", "shortName": "vmware", "dateUpdated": "2026-08-27T17:57:53.054Z"}, "title": "Micrometer StatsD and Logging meter registries line-protocol and log injection vulnerability", "problemTypes": [{"descriptions": [{"lang": "en", "description": "CWE-117 Improper Output Neutralization for Logs", "type": "CWE"}]}], "impacts": [{"descriptions": [{"lang": "en", "value": "Using untrusted, non-normalized input as-is for metrics data (such as metric names, tag keys, or tag values) is a dangerous antipattern that general-purpose instrumentation should never perform."}]}], "affected": [{"vendor": "Spring", "product": "Micrometer", "versions": [{"status": "affected", "version": "1.17.0", "versionType": "custom"}, {"status": "affected", "version": "1.16.0", "lessThanOrEqual": "1.16.6", "versionType": "custom"}, {"status": "affected", "version": "1.15.0", "lessThanOrEqual": "1.15.12", "versionType": "custom"}, {"status": "affected", "version": "1.14.0", "lessThanOrEqual": "1.14.16", "versionType": "custom"}, {"status": "affected", "version": "0", "lessThanOrEqual": "1.9.18", "versionType": "custom"}], "defaultStatus": "unaffected"}], "descriptions": [{"lang": "en", "value": "Using untrusted, non-normalized input as-is for metrics data (such as metric names, tag keys, or tag values) is a dangerous antipattern that general-purpose instrumentation should never perform.\nMicrometer 1.17.0\nMicrometer 1.16.0 - 1.16.6\nMicrometer 1.15.0 - 1.15.12\nMicrometer 1.14.0 - 1.14.16\nMicrometer 1.9.18 and earlier", "supportingMedia": [{"type": "text/html", "base64": false, "value": "<p>Using untrusted, non-normalized input as-is for metrics data (such as metric names, tag keys, or tag values) is a dangerous antipattern that general-purpose instrumentation should never perform.</p><p>Micrometer 1.17.0<br/>Micrometer 1.16.0 - 1.16.6<br/>Micrometer 1.15.0 - 1.15.12<br/>Micrometer 1.14.0 - 1.14.16<br/>Micrometer 1.9.18 and earlier</p>"}]}], "references": [{"url": "https://spring.io/security/cve-2026-59296"}], "metrics": [{"format": "CVSS", "scenarios": [{"lang": "en", "value": "GENERAL"}], "cvssV3_1": {"version": "3.1", "vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:H/A:N", "baseScore": 5.9, "baseSeverity": "MEDIUM", "attackVector": "NETWORK", "attackComplexity": "HIGH", "privilegesRequired": "NONE", "userInteraction": "NONE", "scope": "UNCHANGED", "confidentialityImpact": "NONE", "integrityImpact": "HIGH", "availabilityImpact": "NONE"}}], "source": {"discovery": "UNKNOWN"}}, "adp": [{"problemTypes": [{"descriptions": [{"type": "CWE", "cweId": "CWE-74", "lang": "en", "description": "CWE-74 Improper Neutralization of Special Elements in Output Used by a Downstream Component ('Injection')"}]}], "metrics": [{"other": {"type": "ssvc", "content": {"timestamp": "2026-08-21T11:55:29.457945Z", "id": "CVE-2026-59296", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "partial"}], "role": "CISA Coordinator", "version": "2.0.3"}}}], "title": "CISA ADP Vulnrichment", "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-08-21T16:44:12.342Z"}}]}}

{"dataType": "CVE_RECORD", "containers": {"adp": [{"title": "CISA ADP Vulnrichment", "metrics": [{"other": {"type": "ssvc", "content": {"id": "CVE-2026-59296", "role": "CISA Coordinator", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "partial"}], "version": "2.0.3", "timestamp": "2026-08-21T11:55:29.457945Z"}}}], "problemTypes": [{"descriptions": [{"lang": "en", "type": "CWE", "cweId": "CWE-74", "description": "CWE-74 Improper Neutralization of Special Elements in Output Used by a Downstream Component ('Injection')"}]}], "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-08-21T11:55:35.874Z"}}], "cna": {"title": "Micrometer StatsD and Logging meter registries line-protocol and log injection vulnerability", "source": {"discovery": "UNKNOWN"}, "metrics": [{"format": "CVSS", "cvssV3_1": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 5.9, "attackVector": "NETWORK", "baseSeverity": "MEDIUM", "vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:H/A:N", "integrityImpact": "HIGH", "userInteraction": "NONE", "attackComplexity": "HIGH", "availabilityImpact": "NONE", "privilegesRequired": "NONE", "confidentialityImpact": "NONE"}, "scenarios": [{"lang": "en", "value": "GENERAL"}]}], "affected": [{"vendor": "VMware", "product": "Spring Micrometer", "versions": [{"status": "affected", "version": "1.17.0 - 1.17.0"}, {"status": "affected", "version": "1.16.0 - 1.16.6"}, {"status": "affected", "version": "1.15.0 - 1.15.12"}, {"status": "affected", "version": "1.14.0 - 1.14.16"}, {"status": "affected", "version": "1.9.18 and earlier"}, {"status": "unaffected", "version": "1.17.0.1", "versionType": "enterprise support only"}, {"status": "unaffected", "version": "1.17.1", "versionType": "oss"}, {"status": "unaffected", "version": "1.16.6.1", "versionType": "enterprise support only"}, {"status": "unaffected", "version": "1.16.7", "versionType": "oss"}, {"status": "unaffected", "version": "1.15.13", "versionType": "enterprise support only"}, {"status": "unaffected", "version": "1.14.17", "versionType": "enterprise support only"}, {"status": "unaffected", "version": "1.9.19", "versionType": "enterprise support only"}], "defaultStatus": "affected"}], "datePublic": "2026-08-20T10:42:00.000Z", "references": [{"url": "https://spring.io/security/cve-2026-59296"}], "x_generator": {"engine": "Vulnogram 1.0.4"}, "descriptions": [{"lang": "en", "value": "Using untrusted, non-normalized input as-is for metrics data (such as metric names, tag keys, or tag values) is a dangerous antipattern that general-purpose instrumentation should never perform. When such unsafe instrumentation is used, the application becomes vulnerable to injection and spoofing attacks because\u00a0micrometer-registry-statsd\u00a0and\u00a0micrometer-core\u00a0do not sanitize newline characters (\\n,\u00a0\\r) by default prior to this fix.\n\n * For the StatsD registry in\u00a0micrometer-registry-statsd\u00a0(when using the\u00a0Datadog\u00a0or\u00a0Etsy\u00a0flavor), because the StatsD protocol is newline-delimited, this allows for line-protocol injection (cross-metric spoofing).\n * For\u00a0LoggingMeterRegistry\u00a0in\u00a0micrometer-core, because metric output is printed line-by-line to log files, this allows for both metric spoofing (if downstream log-metrics scrapers or parsers ingest the log lines as separate metrics) and general log spoofing.\n\n\n\n\nSpecifically, an application is vulnerable when all the following are true:\n\n * The application uses a vulnerable version of\u00a0io.micrometer:micrometer-registry-statsd\u00a0or\u00a0io.micrometer:micrometer-core.\n * The application uses the\u00a0Datadog\u00a0or\u00a0Etsy\u00a0flavor of the StatsD registry, or uses\u00a0LoggingMeterRegistry.\n * The application instruments meters using user-controlled, unvalidated input for metric names, tag keys, or tag values.\n\n\n\n\nWhen vulnerable, an attacker can break out of the current metric or log line by injecting line terminators. This allows them to spoof arbitrary metrics (e.g., system load, standard JVM metrics, or other business metrics) across the metrics registry namespace (either directly via StatsD protocol or via downstream log-metric scrapers/parsers), as well as inject arbitrary log entries to spoof general log records.", "supportingMedia": [{"type": "text/html", "value": "<p>Using untrusted, non-normalized input as-is for metrics data (such as metric names, tag keys, or tag values) is a dangerous antipattern that general-purpose instrumentation should never perform. When such unsafe instrumentation is used, the application becomes vulnerable to injection and spoofing attacks because&nbsp;<code>micrometer-registry-statsd</code>&nbsp;and&nbsp;<code>micrometer-core</code>&nbsp;do not sanitize newline characters (<code>\\n</code>,&nbsp;<code>\\r</code>) by default prior to this fix.</p><ul><li>For the StatsD registry in&nbsp;<code>micrometer-registry-statsd</code>&nbsp;(when using the&nbsp;<code>Datadog</code>&nbsp;or&nbsp;<code>Etsy</code>&nbsp;flavor), because the StatsD protocol is newline-delimited, this allows for line-protocol injection (cross-metric spoofing).</li><li>For&nbsp;<code>LoggingMeterRegistry</code>&nbsp;in&nbsp;<code>micrometer-core</code>, because metric output is printed line-by-line to log files, this allows for both metric spoofing (if downstream log-metrics scrapers or parsers ingest the log lines as separate metrics) and general log spoofing.</li></ul><p>Specifically, an application is vulnerable when all the following are true:</p><ul><li>The application uses a vulnerable version of&nbsp;<code>io.micrometer:micrometer-registry-statsd</code>&nbsp;or&nbsp;<code>io.micrometer:micrometer-core</code>.</li><li>The application uses the&nbsp;<code>Datadog</code>&nbsp;or&nbsp;<code>Etsy</code>&nbsp;flavor of the StatsD registry, or uses&nbsp;<code>LoggingMeterRegistry</code>.</li><li>The application instruments meters using user-controlled, unvalidated input for metric names, tag keys, or tag values.</li></ul><p>When vulnerable, an attacker can break out of the current metric or log line by injecting line terminators. This allows them to spoof arbitrary metrics (e.g., system load, standard JVM metrics, or other business metrics) across the metrics registry namespace (either directly via StatsD protocol or via downstream log-metric scrapers/parsers), as well as inject arbitrary log entries to spoof general log records.</p>", "base64": false}]}], "providerMetadata": {"orgId": "dcf2e128-44bd-42ed-91e8-88f912c1401d", "shortName": "vmware", "dateUpdated": "2026-08-21T10:47:25.384Z"}}}, "cveMetadata": {"cveId": "CVE-2026-59296", "state": "PUBLISHED", "dateUpdated": "2026-08-21T16:44:12.342Z", "dateReserved": "2026-07-04T18:13:34.323Z", "assignerOrgId": "dcf2e128-44bd-42ed-91e8-88f912c1401d", "datePublished": "2026-08-21T10:47:25.384Z", "assignerShortName": "vmware"}, "dataVersion": "5.2"}

{"affected": [{"affectedData": [{"defaultStatus": "unaffected", "product": "Micrometer", "vendor": "Spring", "versions": [{"status": "affected", "version": "1.17.0", "versionType": "custom"}, {"lessThanOrEqual": "1.16.6", "status": "affected", "version": "1.16.0", "versionType": "custom"}, {"lessThanOrEqual": "1.15.12", "status": "affected", "version": "1.15.0", "versionType": "custom"}, {"lessThanOrEqual": "1.14.16", "status": "affected", "version": "1.14.0", "versionType": "custom"}, {"lessThanOrEqual": "1.9.18", "status": "affected", "version": "0", "versionType": "custom"}]}], "source": "security@vmware.com"}], "cveTags": [], "descriptions": [{"lang": "en", "value": "Using untrusted, non-normalized input as-is for metrics data (such as metric names, tag keys, or tag values) is a dangerous antipattern that general-purpose instrumentation should never perform.\nMicrometer 1.17.0\nMicrometer 1.16.0 - 1.16.6\nMicrometer 1.15.0 - 1.15.12\nMicrometer 1.14.0 - 1.14.16\nMicrometer 1.9.18 and earlier"}, {"lang": "es", "value": "Usar entrada no confiable y no normalizada tal cual para datos de m\u00e9tricas (como nombres de m\u00e9tricas, claves de etiquetas o valores de etiquetas) es un antipatr\u00f3n peligroso que la instrumentaci\u00f3n de prop\u00f3sito general nunca deber\u00eda realizar. Cuando se utiliza dicha instrumentaci\u00f3n insegura, la aplicaci\u00f3n se vuelve vulnerable a ataques de inyecci\u00f3n y suplantaci\u00f3n porque micrometer-registry-statsd y micrometer-core no sanean los caracteres de nueva l\u00ednea (\\n, \\r) por defecto antes de esta correcci\u00f3n.\n\n* Para el registro StatsD en micrometer-registry-statsd (cuando se utiliza la variante Datadog o Etsy), debido a que el protocolo StatsD est\u00e1 delimitado por nueva l\u00ednea, esto permite la inyecci\u00f3n de protocolo de l\u00ednea (suplantaci\u00f3n de m\u00e9tricas cruzadas).\n* Para LoggingMeterRegistry en micrometer-core, debido a que la salida de m\u00e9tricas se imprime l\u00ednea por l\u00ednea en los archivos de registro, esto permite tanto la suplantaci\u00f3n de m\u00e9tricas (si los raspadores o analizadores de m\u00e9tricas de registro posteriores ingieren las l\u00edneas de registro como m\u00e9tricas separadas) como la suplantaci\u00f3n general de registros.\n\nEspec\u00edficamente, una aplicaci\u00f3n es vulnerable cuando se cumplen todas las siguientes condiciones:\n\n* La aplicaci\u00f3n utiliza una versi\u00f3n vulnerable de io.micrometer:micrometer-registry-statsd o io.micrometer:micrometer-core.\n* La aplicaci\u00f3n utiliza la variante Datadog o Etsy del registro StatsD, o utiliza LoggingMeterRegistry.\n* La aplicaci\u00f3n instrumenta medidores utilizando entrada controlada por el usuario y no validada para nombres de m\u00e9tricas, claves de etiquetas o valores de etiquetas.\n\nCuando es vulnerable, un atacante puede escapar de la m\u00e9trica o l\u00ednea de registro actual inyectando terminadores de l\u00ednea. Esto les permite suplantar m\u00e9tricas arbitrarias (por ejemplo, carga del sistema, m\u00e9tricas JVM est\u00e1ndar u otras m\u00e9tricas de negocio) en todo el espacio de nombres del registro de m\u00e9tricas (ya sea directamente a trav\u00e9s del protocolo StatsD o a trav\u00e9s de raspadores/analizadores de m\u00e9tricas de registro posteriores), as\u00ed como inyectar entradas de registro arbitrarias para suplantar registros de registro generales."}], "id": "CVE-2026-59296", "lastModified": "2026-10-16T15:10:00.103", "metrics": {"cvssMetricV31": [{"cvssData": {"attackComplexity": "HIGH", "attackVector": "NETWORK", "availabilityImpact": "NONE", "baseScore": 5.9, "baseSeverity": "MEDIUM", "confidentialityImpact": "NONE", "integrityImpact": "HIGH", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:H/A:N", "version": "3.1"}, "exploitabilityScore": 2.2, "impactScore": 3.6, "source": "security@vmware.com", "type": "Secondary"}], "ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2026-59296", "options": [{"exploitation": "none"}, {"automatable": "no"}, {"technicalImpact": "partial"}], "role": "CISA Coordinator", "timestamp": "2026-08-21T11:55:29.457945Z", "version": "2.0.3"}}]}, "published": "2026-08-21T11:17:05.780", "references": [{"source": "security@vmware.com", "url": "https://spring.io/security/cve-2026-59296"}], "sourceIdentifier": "security@vmware.com", "vulnStatus": "Awaiting Analysis", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-74"}], "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "type": "Secondary"}]}

{"bugzilla": {"description": "io.micrometer/micrometer-registry-statsd: io.micrometer/micrometer-core: Micrometer: Line-protocol and log injection via unsanitized input allows metric and log spoofing", "id": "2520949", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2520949"}, "csaw": false, "cvss3": {"cvss3_base_score": "5.9", "cvss3_scoring_vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:H/A:N", "status": "draft"}, "cwe": "CWE-93", "details": ["Using untrusted, non-normalized input as-is for metrics data (such as metric names, tag keys, or tag values) is a dangerous antipattern that general-purpose instrumentation should never perform. When such unsafe instrumentation is used, the application becomes vulnerable to injection and spoofing attacks because\u00a0micrometer-registry-statsd\u00a0and\u00a0micrometer-core\u00a0do not sanitize newline characters (\\n,\u00a0\\r) by default prior to this fix.\n* For the StatsD registry in\u00a0micrometer-registry-statsd\u00a0(when using the\u00a0Datadog\u00a0or\u00a0Etsy\u00a0flavor), because the StatsD protocol is newline-delimited, this allows for line-protocol injection (cross-metric spoofing).\n* For\u00a0LoggingMeterRegistry\u00a0in\u00a0micrometer-core, because metric output is printed line-by-line to log files, this allows for both metric spoofing (if downstream log-metrics scrapers or parsers ingest the log lines as separate metrics) and general log spoofing.\nSpecifically, an application is vulnerable when all the following are true:\n* The application uses a vulnerable version of\u00a0io.micrometer:micrometer-registry-statsd\u00a0or\u00a0io.micrometer:micrometer-core.\n* The application uses the\u00a0Datadog\u00a0or\u00a0Etsy\u00a0flavor of the StatsD registry, or uses\u00a0LoggingMeterRegistry.\n* The application instruments meters using user-controlled, unvalidated input for metric names, tag keys, or tag values.\nWhen vulnerable, an attacker can break out of the current metric or log line by injecting line terminators. This allows them to spoof arbitrary metrics (e.g., system load, standard JVM metrics, or other business metrics) across the metrics registry namespace (either directly via StatsD protocol or via downstream log-metric scrapers/parsers), as well as inject arbitrary log entries to spoof general log records.", "A flaw was found in Micrometer's StatsD and Logging meter registries. This vulnerability allows a remote attacker to inject line terminators into metric data, such as names or tag values, due to insufficient sanitization of untrusted input. Exploitation can lead to the spoofing of arbitrary metrics, including critical system or business metrics, and the injection of false log entries, potentially impacting monitoring and auditing systems."], "name": "CVE-2026-59296", "package_state": [{"cpe": "cpe:/a:redhat:exploit_intelligence:0", "fix_state": "Out of support scope", "package_name": "exploit-intelligence/agent-client-rhel9", "product_name": "Exploit Intelligence"}, {"cpe": "cpe:/a:redhat:amq_broker:7", "fix_state": "Affected", "package_name": "micrometer-core", "product_name": "Red Hat AMQ Broker 7"}, {"cpe": "cpe:/a:redhat:camel_quarkus:3", "fix_state": "Affected", "package_name": "micrometer-core", "product_name": "Red Hat build of Apache Camel 4 for Quarkus 3"}, {"cpe": "cpe:/a:redhat:camel_spring_boot:4", "fix_state": "Affected", "package_name": "micrometer-core", "product_name": "Red Hat build of Apache Camel for Spring Boot 4"}, {"cpe": "cpe:/a:redhat:apicurio_registry:3", "fix_state": "Out of support scope", "package_name": "micrometer-core", "product_name": "Red Hat build of Apicurio Registry 3"}, {"cpe": "cpe:/a:redhat:debezium:3", "fix_state": "Affected", "package_name": "micrometer-core", "product_name": "Red Hat build of Debezium 3"}, {"cpe": "cpe:/a:redhat:build_keycloak:", "fix_state": "Affected", "package_name": "keycloak/rhbk-openshift-rhel9", "product_name": "Red Hat Build of Keycloak"}, {"cpe": "cpe:/a:redhat:build_keycloak:", "fix_state": "Affected", "package_name": "keycloak/rhbk-rhel9-operator", "product_name": "Red Hat Build of Keycloak"}, {"cpe": "cpe:/a:redhat:build_keycloak:", "fix_state": "Affected", "package_name": "micrometer-core", "product_name": "Red Hat Build of Keycloak"}, {"cpe": "cpe:/a:redhat:build_keycloak:", "fix_state": "Affected", "package_name": "rhbk/keycloak-rhel9", "product_name": "Red Hat Build of Keycloak"}, {"cpe": "cpe:/a:redhat:build_keycloak:", "fix_state": "Out of support scope", "package_name": "rhbk/keycloak-rhel9-operator", "product_name": "Red Hat Build of Keycloak"}, {"cpe": "cpe:/a:redhat:quarkus:3", "fix_state": "Affected", "package_name": "micrometer-core", "product_name": "Red Hat build of Quarkus"}, {"cpe": "cpe:/a:redhat:jboss_data_grid:8", "fix_state": "Out of support scope", "package_name": "micrometer-core", "product_name": "Red Hat Data Grid 8"}, {"cpe": "cpe:/a:redhat:jboss_fuse:7", "fix_state": "Out of support scope", "package_name": "micrometer-core", "product_name": "Red Hat Fuse 7"}, {"cpe": "cpe:/a:redhat:jboss_enterprise_application_platform:8", "fix_state": "Not affected", "package_name": "micrometer-core", "product_name": "Red Hat JBoss Enterprise Application Platform 8"}, {"cpe": "cpe:/a:redhat:jbosseapxp", "fix_state": "Affected", "package_name": "micrometer-core", "product_name": "Red Hat JBoss Enterprise Application Platform Expansion Pack"}, {"cpe": "cpe:/a:redhat:openshift_ai", "fix_state": "Affected", "package_name": "rhoai/odh-trustyai-service-rhel9", "product_name": "Red Hat OpenShift AI (RHOAI)"}, {"cpe": "cpe:/a:redhat:openshift_devspaces:3", "fix_state": "Affected", "package_name": "devspaces/openvsx-rhel9", "product_name": "Red Hat OpenShift Dev Spaces"}, {"cpe": "cpe:/a:redhat:openshift_devspaces:3", "fix_state": "Affected", "package_name": "devspaces/pluginregistry-rhel9", "product_name": "Red Hat OpenShift Dev Spaces"}, {"cpe": "cpe:/a:redhat:openshift_devspaces:3", "fix_state": "Affected", "package_name": "devspaces/server-rhel9", "product_name": "Red Hat OpenShift Dev Spaces"}, {"cpe": "cpe:/a:redhat:satellite:6", "fix_state": "Not affected", "package_name": "candlepin", "product_name": "Red Hat Satellite 6"}, {"cpe": "cpe:/a:redhat:satellite:6", "fix_state": "Not affected", "package_name": "satellite:el8/candlepin", "product_name": "Red Hat Satellite 6"}], "public_date": "2026-08-21T10:47:25Z", "references": ["https://www.cve.org/CVERecord?id=CVE-2026-59296\nhttps://nvd.nist.gov/vuln/detail/CVE-2026-59296\nhttps://spring.io/security/cve-2026-59296"], "threat_severity": "Moderate"}

{"affected": [{"configurations": [{"platform": null, "status": "affected", "versions": {"scheme": "semver", "value": "1.17.0"}}, {"platform": null, "status": "affected", "versions": {"scheme": "semver", "value": "[1.16.0,1.16.6]"}}, {"platform": null, "status": "affected", "versions": {"scheme": "semver", "value": "[1.15.0,1.15.12]"}}, {"platform": null, "status": "affected", "versions": {"scheme": "semver", "value": "[1.14.0,1.14.16]"}}, {"platform": null, "status": "affected", "versions": {"scheme": "semver", "value": "[0,1.9.18]"}}, {"platform": null, "status": "unaffected", "versions": {"scheme": "generic", "value": "1.17.0.1"}}, {"platform": null, "status": "unaffected", "versions": {"scheme": "semver", "value": "1.17.1"}}, {"platform": null, "status": "unaffected", "versions": {"scheme": "generic", "value": "1.16.6.1"}}, {"platform": null, "status": "unaffected", "versions": {"scheme": "semver", "value": "1.16.7"}}, {"platform": null, "status": "unaffected", "versions": {"scheme": "semver", "value": "1.15.13"}}, {"platform": null, "status": "unaffected", "versions": {"scheme": "semver", "value": "1.14.17"}}, {"platform": null, "status": "unaffected", "versions": {"scheme": "semver", "value": "1.9.19"}}], "enrichment": {"confidence": 83.0, "confidence_source": "matching", "scores": [{"score": 83.0, "source": "matching"}]}, "original": {"product": "Spring Micrometer", "source": "cna", "vendor": "VMware"}, "product": "micrometer", "vendor": "spring"}], "created": "2026-08-21T12:30:14.456791+00:00", "updated": "2026-08-28T20:30:08.451571+00:00", "vendors": ["spring", "spring$PRODUCT$micrometer"]}