Description
VictoriaMetrics is a scalable solution for monitoring and managing time series data. In versions from 1.0.0 to before 1.110.23, from 1.111.0 to before 1.122.8, and from 1.123.0 to before 1.129.1, affected versions are vulnerable to DoS attacks because the snappy decoder ignored VictoriaMetrics request size limits allowing malformed blocks to trigger excessive memory use. This could lead to OOM errors and service instability. The fix enforces block-size checks based on MaxRequest limits. This issue has been patched in versions 1.110.23, 1.122.8, and 1.129.1.
Affected products
| Vendor | Product | Affected | Fixed |
|---|---|---|---|
| VictoriaMetrics | VictoriaMetrics | >= 1.0.0, < 1.110.23, >= 1.111.0, < 1.122.8, >= 1.123.0, < 1.129.1 | — |
Fixed in Linux distributions
Distributions backport fixes, so the version that fixes this vulnerability differs per release — upgrade to at least the version shown. From the distributions' security trackers and advisories.
openSUSE
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| openSUSE Leap 16.0 | govulncheck-vulndb | 0.0.20260723T184607-160000.1.1 | openSUSE-SU-2026:21483-1 |
| openSUSE Leap 15.6 | govulncheck-vulndb | 0.0.20251230T014957-150000.1.134.1 | SUSE-SU-2026:0037-1 |
Affected packages
| Ecosystem | Package | Affected | Fixed | Record |
|---|---|---|---|---|
| Go | github.com/VictoriaMetrics/VictoriaMetrics | >= 1.123.0, < 1.129.1 | 1.129.1 | GHSA-66jq-2c23-2xh5 |
| Go | github.com/VictoriaMetrics/VictoriaMetrics | >= 1.111.0, < 1.122.8 | 1.122.8 | GHSA-66jq-2c23-2xh5 |
| Go | github.com/VictoriaMetrics/VictoriaMetrics | >= 1.0.0, < 1.110.23 | 1.110.23 | GHSA-66jq-2c23-2xh5 |
| Go | github.com/VictoriaMetrics/VictoriaMetrics | < 1.110.23 · >= 1.111.0, < 1.122.8 · >= 1.123.0, < 1.129.1 | 1.110.23, 1.122.8, 1.129.1 | GO-2025-4161 |
Advisories 2
- openSUSE-SU-2026:21483-1 Security update for govulncheck-vulndb SUSE / openSUSE Security Updates · Jul 31, 2026
- SUSE-SU-2026:0037-1 Security update for govulncheck-vulndb SUSE / openSUSE Security Updates · Mar 23, 2026
References
- https://github.com/VictoriaMetrics/VictoriaMetrics/security/advisories/GHSA-66jq-2c23-2xh5
- https://github.com/VictoriaMetrics/VictoriaMetrics/commit/51b44afd34d2c9a392d4ebedeeb5b4a7f5beca24
- https://github.com/VictoriaMetrics/VictoriaMetrics/releases/tag/v1.110.23
- https://github.com/VictoriaMetrics/VictoriaMetrics/releases/tag/v1.122.8
- https://github.com/VictoriaMetrics/VictoriaMetrics/releases/tag/v1.129.1