GHSA-8rm2-7qqf-34qm
Prometheus: Remote read endpoint allows denial of service via crafted snappy payload
En bref
- Publiée
- Mise à jour
- CVE
- CVE-2026-42154
- Alias
- BIT-prometheus-2026-42154, GO-2026-5264
- CVSS_V3
- CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Description
### Impact The remote read endpoint (`/api/v1/read`) does not validate the declared decoded length in a snappy-compressed request body before allocating memory. An unauthenticated attacker can send a small payload that causes a huge heap allocation per request. Under concurrent load this can exhaust available memory and crash the Prometheus process. ### Patches _Has the problem been patched? What versions should users upgrade to?_ Fixed in 3.11.3 and 3.5.3 LTS. Users should upgrade to these versions or later. ### Workarounds User who can not upgrade can place Prometheus behind a reverse proxy or firewall that requires authentication before requests reach /api/v1/read.
Paquets affectés
| Paquet | Versions |
|---|---|
| Go · github.com/prometheus/prometheus | introduced 0.306.0, fixed 0.311.3 |
| Go · github.com/prometheus/prometheus | introduced 0, fixed 0.305.2 |
| Go · github.com/prometheus/prometheus | introduced 1.0.0-rc.0, last affected 2.5.0 |
Références
- https://github.com/prometheus/prometheus/security/advisories/GHSA-8rm2-7qqf-34qm WEB
- https://nvd.nist.gov/vuln/detail/CVE-2026-42154 ADVISORY
- https://github.com/prometheus/prometheus/pull/18584 WEB
- https://github.com/prometheus/prometheus/pull/18585 WEB
- https://github.com/prometheus/prometheus PACKAGE
- https://github.com/prometheus/prometheus/releases/tag/v3.11.3 WEB
- https://github.com/prometheus/prometheus/releases/tag/v3.5.3 WEB
Sources
| Source | Licence |
|---|---|
| OSV.dev | CC-BY 4.0 — GitHub Advisory Database |