CLEANSTART-2026-QP62862 Using untrusted, non-normalized input as-is for metrics data (such as metric names, tag keys, or tag values) is a dangerous antipattern that general-purpose instrumentation should never perform

🗓️ 30 Oct 2026 12:56:04Reported by GoogleType

osv_cleanstart🔗 osv.dev👁 10 Views

Untrusted, non-normalized input for metrics data in the keycloak package.

Reporter	Title	Published	Views	Family All 59
IBM Security Bulletins	Security Bulletin: Security vulnerabilities have been identified in third party libraries shipped with IBM Guardium Cryptography Manager (GCM)	29 Oct 202612:35	–	ibm
IBM Security Bulletins	Security Bulletin: IBM Guardium Data Protection is affected by multiple vulnerabilities	22 Oct 202612:32	–	ibm
IBM Security Bulletins	Security Bulletin: IBM Watson Speech Services Cartridge is vulnerable to DoS and injection issues in Micrometer (CVE-2026-59295, CVE-2026-59296)	22 Oct 202620:13	–	ibm
IBM Security Bulletins	Security Bulletin: IBM Decision Intelligence Client Managed Software (Formerly Known as IBM Automation Decision Services) for Sept 2026- Multiple CVEs addressed	5 Oct 202616:26	–	ibm
Chainguard	CVE-2026-59296 vulnerabilities	30 Sep 202620:54	–	cgr
CVE	CVE-2026-59296	21 Aug 202610:47	–	cve
Cvelist	CVE-2026-59296 Micrometer StatsD and Logging meter registries line-protocol and log injection vulnerability	21 Aug 202610:47	–	cvelist
EUVD	EUVD-2026-63885	21 Aug 202610:47	–	euvd
Mend	CVE-2026-59296	21 Aug 202610:47	–	mend
NVD	CVE-2026-59296	21 Aug 202611:17	–	nvd

Source	Link
github	www.github.com/cleanstart-dev/cleanstart-security-advisories/tree/main/advisories/2026/CLEANSTART-2026-QP62862.json
osv	www.osv.dev/vulnerability/CVE-2026-59296
nvd	www.nvd.nist.gov/vuln/detail/CVE-2026-59296

31 Oct 2026 01:00Current

7.3High risk

Vulners AI Score7.3

CVSS 3.15.9

EPSS0.00301

keycloak metrics data non-normalized input