cnitch

cnitch cnitch snitch or container snitch is a simple framework and command line tool for monitoring Docker containers to identify any processes which are running as root. Why is this a bad thing? If you have not already been to can I haz non-privileged containers? by mhausenblas then I recommend...

io.micrometer/micrometer-registry-statsd: io.micrometer/micrometer-core: Micrometer: Line-protocol and log injection via unsanitized input allows metric and log spoofing

A flaw was found in Micrometer's StatsD and Logging meter registries. This vulnerability allows a remote attacker to inject line terminators into metric data, such as names or tag values, due to insufficient sanitization of untrusted input. Exploitation can lead to the spoofing of arbitrary...

io.micrometer/micrometer-registry-statsd: io.micrometer/micrometer-core: Micrometer: Line-protocol and log injection via unsanitized input allows metric and log spoofing

A flaw was found in Micrometer's StatsD and Logging meter registries. This vulnerability allows a remote attacker to inject line terminators into metric data, such as names or tag values, due to insufficient sanitization of untrusted input. Exploitation can lead to the spoofing of arbitrary...

CLEANSTART-2026-AW19890 Security fixes in prometheus-statsd-exporter 0.27.2-r1

Package prometheus-statsd-exporter version 0.27.2-r1 fixes 10 vulnerabilities: ghsa-259r-337f-4rfw, CVE-2026-39821, CVE-2026-56860, CVE-2026-56858, CVE-2026-33818...

CLEANSTART-2026-DO56423 Security fixes in prometheus-statsd-exporter 0.29.0-r0

Package prometheus-statsd-exporter version 0.29.0-r0 fixes 9 vulnerabilities: CVE-2026-39821, CVE-2026-56860, CVE-2026-56858, CVE-2026-33818, CVE-2026-46600...

CVE-2026-59296

A flaw was found in Micrometer's StatsD and Logging meter registries. This vulnerability allows a remote attacker to inject line terminators into metric data, such as names or tag values, due to insufficient sanitization of untrusted input. Exploitation can lead to the spoofing of arbitrary...

CRLF Injection

Overview Affected versions of this package are vulnerable to CRLF Injection through DatadogStatsdLineBuilder, EtsyStatsdLineBuilder, and the Printer in LoggingMeterRegistry. An attacker can spoof metrics or log entries by supplying meter names, tag keys, or tag values containing \n or \r, causing...

CRLF Injection

Overview Affected versions of this package are vulnerable to CRLF Injection through DatadogStatsdLineBuilder, EtsyStatsdLineBuilder, and the Printer in LoggingMeterRegistry. An attacker can spoof metrics or log entries by supplying meter names, tag keys, or tag values containing \n or \r, causing...

CVE-2026-59296

Using untrusted, non-normalized input as-is for metrics data such as metric names, tag keys, or tag values is a dangerous antipattern that general-purpose instrumentation should never perform. Micrometer 1.17.0 Micrometer 1.16.0 - 1.16.6 Micrometer 1.15.0 - 1.15.12 Micrometer 1.14.0 - 1.14.16...

EUVD-2026-63885

Using untrusted, non-normalized input as-is for metrics data such as metric names, tag keys, or tag values is a dangerous antipattern that general-purpose instrumentation should never perform. When such unsafe instrumentation is used, the application becomes vulnerable to injection and spoofing...

CVE-2026-59296

CVE-2026-59296 affects io.micrometer:micrometer-registry-statsd and io.micrometer:micrometer-core , which do not sanitize newline characters (\n, \r) in metric names, tag keys, or tag values by default. When an application instruments meters using user-controlled, unvalidated input , an attacker ...

CVE-2026-59296 Micrometer StatsD and Logging meter registries line-protocol and log injection vulnerability

Using untrusted, non-normalized input as-is for metrics data such as metric names, tag keys, or tag values is a dangerous antipattern that general-purpose instrumentation should never perform. Micrometer 1.17.0 Micrometer 1.16.0 - 1.16.6 Micrometer 1.15.0 - 1.15.12 Micrometer 1.14.0 - 1.14.16...

CVE-2026-59296 Micrometer StatsD and Logging meter registries line-protocol and log injection vulnerability

Using untrusted, non-normalized input as-is for metrics data such as metric names, tag keys, or tag values is a dangerous antipattern that general-purpose instrumentation should never perform. When such unsafe instrumentation is used, the application becomes vulnerable to injection and spoofing...

PT-2026-79355

Name of the Vulnerable Software and Affected Versions io.micrometer:micrometer-registry-statsd affected versions not specified io.micrometer:micrometer-core affected versions not specified Description Failure to sanitize newline characters , r in metrics data allows for injection and spoofing...

GO-2021-0064 vulnerabilities

Vulnerabilities for packages: gostatsd, newrelic-nri-statsd, kubeflow-pipelines, spark-operator...

GO-2023-2382 vulnerabilities

Vulnerabilities for packages: aactl, cni-plugins, cni-plugins-fips, configmap-reload-fips, docker-credential-ecr-login, smarter-device-manager, bank-vaults-fips, kubernetes-csi-livenessprobe, kind, nri-discovery-kubernetes, metrics-server, prometheus-stackdriver-exporter,...

GO-2021-0064 vulnerabilities

Vulnerabilities for packages: kubeflow-pipelines, newrelic-nri-statsd, gostatsd, spark-operator...

CLEANSTART-2026-PW64435 Security fixes in prometheus-statsd-exporter 0.28.0-r1

Package prometheus-statsd-exporter version 0.28.0-r1 fixes 4 vulnerabilities: CVE-2026-25679, CVE-2026-27139, CVE-2026-27142, CVE-2026-27141...

CVE-2026-48706

A flaw was found in Envoy, an open-source edge and service proxy. An attacker can exploit a heap write overflow vulnerability in Envoy's TCP StatsD sink by sending exceptionally long statistic names, such as those found in HTTP or gRPC request paths. This can lead to a denial-of-service, causing...

BIT-ENVOY-2026-48706 Envoy Heap Buffer Overflow in TcpStatsdSink

Envoy is an open source edge and service proxy designed for cloud-native applications. From 1.34.0 until 1.35.13, 1.36.9, 1.37.5, and 1.38.3, a vulnerability exists in Envoy's TCP StatsD sink TcpStatsdSink, where the thread-local flusher buffer can be overflowed by exceptionally long statistic...