Security context

What an agent needs to avoid regressing past fixes and find the next vuln in this repo.

micrometer-metrics/micrometer

              main @ 3e4d2a7
            

Fixes

CVEs

MEDIUM

Peak severity

Highlights

JSON Injection: 1 prior fix. Scrutinize any change in this area.

implementations/micrometer-registry-new-relic: most-fixed (1 issue). Treat as high-risk during review.

0 high-severity fixes in this history; regressions here are high-impact.

Recurring patterns

The bug types that recur here, drawn from past fixes, not open vulnerabilities.

JSON Injection: Unsanitized meter names, tag keys, or tag values can allow attackers to inject arbitrary JSON elements into telemetry payloads sent to New Relic, corrupting dashboards or metrics.

JSON Injection: Dynamic metric tags sent to SignalFx without proper JSON escaping can manipulate the structure of the API request payload.

JSON Injection: Lack of character escaping in Wavefront metric naming conventions permits control characters to leak into the exported telemetry payload.