Description
Prometheus is an open-source monitoring system and time series database. Prior to versions 3.5.3 and 3.11.3, the remote read endpoint (/api/v1/read) does not validate the declared decoded length in a snappy-compressed request body before allocating memory. An unauthenticated attacker can send a small payload that causes a huge heap allocation per request. Under concurrent load this can exhaust available memory and crash the Prometheus process. This issue has been patched in versions 3.5.3 and 3.11.3.
Affected products
| Vendor | Product | Affected | Fixed |
|---|---|---|---|
| prometheus | prometheus | < 3.5.3, >= 3.6.0, < 3.11.3 | — |
Fixed in Linux distributions
Distributions backport fixes, so the version that fixes this vulnerability differs per release — upgrade to at least the version shown. From the distributions' security trackers and advisories.
Debian
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Debian 14 | prometheus | 3.5.3+ds1-1 | — |
| Debian 13 | prometheus | No fix yet | — |
| Debian 12 | prometheus | No fix yet | — |
Ubuntu
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Ubuntu 26.10 | prometheus | No fix yet | — |
| Ubuntu 25.10 | prometheus | No fix yet | — |
| Ubuntu 20.04 LTS | prometheus | No fix yet | — |
| Ubuntu 18.04 LTS | prometheus | No fix yet | — |
| Ubuntu 16.04 LTS | prometheus | No fix yet | — |
Show 3 more (older releases, extended support, other products)Fewer releases
| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Ubuntu Pro 26.04 LTS | prometheus | No fix yet | — |
| Ubuntu Pro 24.04 LTS | prometheus | No fix yet | — |
| Ubuntu Pro 22.04 LTS | prometheus | No fix yet | — |
Red Hat
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| RHEL 10 | opentelemetry-collector | 0.152.1-1.el10_2 | RHSA-2026:34357 |
| RHEL 9 | opentelemetry-collector | 0.152.1-1.el9_8 | RHSA-2026:34359 |
Show 5 more (older releases, extended support, other products)Fewer releases
| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| RHEL 10.0 EUS | opentelemetry-collector | 0.152.1-1.el10_0 | RHSA-2026:53413 |
| RHEL 9.6 EUS | opentelemetry-collector | 0.152.1-1.el9_6 | RHSA-2026:53415 |
| RHEL 9.4 E4S | opentelemetry-collector | 0.152.1-1.el9_4 | RHSA-2026:53412 |
| Red Hat Hardened Images 1 | jaeger | 2.19.0-1.hum1 | RHSA-2026:25039 |
| Red Hat Hardened Images 1 | opentelemetry-collector | 0.153.0-1.hum1 | RHSA-2026:25245 |
| Red Hat Hardened Images 1 | opentelemetry-collector-contrib | 0.155.0-0.1.hum1 | RHSA-2026:29770 |
| Red Hat Edge Manager 1 | flightctl +3 | 1.0.3-1.el9em | RHSA-2026:41019, RHSA-2026:36796 |
AlmaLinux
Errata ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| AlmaLinux 10 | opentelemetry-collector | 0.152.1-1.el10_2 | ALSA-2026:34357 |
| AlmaLinux 9 | opentelemetry-collector | 0.152.1-1.el9_8 | ALSA-2026:34359 |
Rocky Linux
Errata ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Rocky Linux 10 | opentelemetry-collector | 0.152.1-1.el10_2 | RLSA-2026:34357 |
| Rocky Linux 9 | opentelemetry-collector | 0.152.1-1.el9_8 | RLSA-2026:34359 |
SUSE
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| SUSE Multi Linux Manager Tools SLE-Micro-5 | dracut-saltboot | 1.2.1-150002.3.9.1 | SUSE-SU-2026:2768-1 |
| SUSE Multi Linux Manager Tools SLE-Micro-5 | golang-github-prometheus-node_exporter | 1.10.2-150002.3.6.2 | SUSE-SU-2026:2768-1 |
| SUSE Multi Linux Manager Tools SLE-Micro-5 | uyuni-tools | 5.2.12-150002.3.17.1 | SUSE-SU-2026:2768-1 |
| SUSE Multi Linux Manager Tools SLE-15 | dracut-saltboot | 1.2.1-150002.3.9.1 | SUSE-SU-2026:2768-1 |
| SUSE Multi Linux Manager Tools SLE-15 | golang-github-QubitProducts-exporter_exporter | 0.4.0-150002.3.6.2 | SUSE-SU-2026:2768-1 |
| SUSE Multi Linux Manager Tools SLE-15 | golang-github-boynux-squid_exporter | 1.13.0-150002.3.6.2 | SUSE-SU-2026:2768-1 |
| SUSE Multi Linux Manager Tools SLE-15 | golang-github-lusitaniae-apache_exporter | 1.0.10-150002.3.9.2 | SUSE-SU-2026:2768-1 |
| SUSE Multi Linux Manager Tools SLE-15 | golang-github-prometheus-alertmanager | 0.28.1-150002.4.11.1 | SUSE-SU-2026:2768-1 |
| SUSE Multi Linux Manager Tools SLE-15 | golang-github-prometheus-node_exporter | 1.10.2-150002.3.6.2 | SUSE-SU-2026:2768-1 |
| SUSE Multi Linux Manager Tools SLE-15 | golang-github-prometheus-prometheus | 3.5.3-150002.3.13.1 | SUSE-SU-2026:2768-1 |
| SUSE Multi Linux Manager Tools SLE-15 | grafana | 11.6.14+security04-150002.4.21.1 | SUSE-SU-2026:2768-1 |
| SUSE Multi Linux Manager Tools SLE-15 | mgr-push | 5.2.4-150002.3.9.1 | SUSE-SU-2026:2768-1 |
| SUSE Multi Linux Manager Tools SLE-15 | prometheus-blackbox_exporter | 0.26.0-150002.3.11.1 | SUSE-SU-2026:2768-1 |
| SUSE Multi Linux Manager Tools SLE-15 | prometheus-postgres_exporter | 0.10.1-150002.3.3.2 | SUSE-SU-2026:2768-1 |
| SUSE Multi Linux Manager Tools SLE-15 | python-defusedxml-sle15 | 0.7.1-150002.1.3.1 | SUSE-SU-2026:2768-1 |
| SUSE Multi Linux Manager Tools SLE-15 | rhnlib | 5.2.5-150002.3.9.1 | SUSE-SU-2026:2768-1 |
| SUSE Multi Linux Manager Tools SLE-15 | spacecmd | 5.2.8-150002.3.12.1 | SUSE-SU-2026:2768-1 |
| SUSE Multi Linux Manager Tools SLE-15 | spacewalk-client-tools | 5.2.6-150002.3.9.1 | SUSE-SU-2026:2768-1 |
| SUSE Multi Linux Manager Tools SLE-15 | supportutils-plugin-salt | 1.2.3-150002.3.3.1 | SUSE-SU-2026:2768-1 |
| SUSE Multi Linux Manager Tools SLE-15 | supportutils-plugin-susemanager-client | 5.2.3-150002.3.9.1 | SUSE-SU-2026:2768-1 |
| SUSE Multi Linux Manager Tools SLE-15 | uyuni-common-libs | 5.2.5-150002.3.6.1 | SUSE-SU-2026:2768-1 |
| SUSE Multi Linux Manager Tools SLE-15 | uyuni-tools | 5.2.12-150002.3.17.1 | SUSE-SU-2026:2768-1 |
| SUSE Multi-Linux Manager Server Extension for SLE 5.1 | suse-multi-linux-manager-5.1-s390x-server-attestation-image +3 | 5.1.4-8.22.10 | SUSE-SU-2026:2774-1 |
| SUSE Multi-Linux Manager Server Extension for SLE 5.1 | suse-multi-linux-manager-5.1-s390x-server-hub-xmlrpc-api-image +3 | 5.1.4-8.20.12 | SUSE-SU-2026:2774-1 |
| SUSE Multi-Linux Manager Server Extension for SLE 5.1 | suse-multi-linux-manager-5.1-s390x-server-image +3 | 5.1.4-8.20.34 | SUSE-SU-2026:2774-1 |
| SUSE Multi-Linux Manager Server Extension for SLE 5.1 | suse-multi-linux-manager-5.1-s390x-server-migration-14-16-image +3 | 5.1.4-8.20.13 | SUSE-SU-2026:2774-1 |
| SUSE Multi-Linux Manager Server Extension for SLE 5.1 | suse-multi-linux-manager-5.1-s390x-server-postgresql-image +3 | 5.1.4-6.24.3 | SUSE-SU-2026:2774-1 |
| SUSE Multi-Linux Manager Server Extension for SLE 5.1 | suse-multi-linux-manager-5.1-s390x-server-saline-image +3 | 5.1.4-9.20.24 | SUSE-SU-2026:2774-1 |
| SUSE Multi-Linux Manager Server Extension for SLE 5.1 | uyuni-tools | 5.1.29-150700.3.26.1 | SUSE-SU-2026:2774-1 |
Show 1 more (older releases, extended support, other products)Fewer releases
| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| SUSE Multi-Linux Manager Proxy Extension for SLE 5.1 | suse-multi-linux-manager-5.1-s390x-proxy-httpd-image +3 | 5.1.4-8.22.22 | SUSE-SU-2026:2774-1 |
| SUSE Multi-Linux Manager Proxy Extension for SLE 5.1 | suse-multi-linux-manager-5.1-s390x-proxy-salt-broker-image +3 | 5.1.4-9.20.25 | SUSE-SU-2026:2774-1 |
| SUSE Multi-Linux Manager Proxy Extension for SLE 5.1 | suse-multi-linux-manager-5.1-s390x-proxy-squid-image +3 | 5.1.4-8.20.11 | SUSE-SU-2026:2774-1 |
| SUSE Multi-Linux Manager Proxy Extension for SLE 5.1 | suse-multi-linux-manager-5.1-s390x-proxy-ssh-image +3 | 5.1.4-8.20.12 | SUSE-SU-2026:2774-1 |
| SUSE Multi-Linux Manager Proxy Extension for SLE 5.1 | suse-multi-linux-manager-5.1-s390x-proxy-tftpd-image +3 | 5.1.4-8.20.13 | SUSE-SU-2026:2774-1 |
| SUSE Multi-Linux Manager Proxy Extension for SLE 5.1 | uyuni-tools | 5.1.29-150700.3.26.1 | SUSE-SU-2026:2774-1 |
openSUSE
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| openSUSE Tumbleweed | golang-github-prometheus-prometheus | 3.11.3-1.1 | openSUSE-SU-2026:10676-1 |
| openSUSE Leap 16.0 | govulncheck-vulndb | 0.0.20260723T184607-160000.1.1 | openSUSE-SU-2026:21483-1 |
Alpine
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Alpine v3.24 | prometheus | 3.5.3-r0 | — |
| Alpine v3.23 | prometheus | 3.5.3-r0 | — |
Amazon Linux
| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Amazon Linux 2023 | amazon-cloudwatch-agent | 1.300066.2-2.amzn2023 | ALAS2023-2026-1747 |
| Amazon Linux 2 | amazon-cloudwatch-agent | 1.300066.2-2.amzn2 | ALAS2-2026-3323 |
Azure Linux
| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Azure Linux 3 | telegraf | 1.31.0-22 | — |
Wolfi
| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Wolfi rolling | amazon-cloudwatch-agent | 1.300074.1-r2 | — |
| Wolfi rolling | amazon-cloudwatch-agent-operator | 3.5.0-r4 | — |
| Wolfi rolling | aws-otel-collector | 0.49.0-r0 | — |
| Wolfi rolling | certificate-transparency | 1.3.3-r22 | — |
| Wolfi rolling | certificate-transparency-trillian-ctserver | 1.3.3-r13 | — |
| Wolfi rolling | cloud-sql-proxy-2.16 | 2.16.0-r20 | — |
| Wolfi rolling | cloud-sql-proxy-2.21 | 2.21.3-r4 | — |
| Wolfi rolling | cloud-sql-proxy-2.22 | 2.22.1-r1 | — |
| Wolfi rolling | cloud-sql-proxy-2.23 | 2.23.0-r0 | — |
| Wolfi rolling | cortex +7 | No fix yet | — |
| Wolfi rolling | datadog-agent-7.77 +2 | 7.77.3-r21 | — |
| Wolfi rolling | datadog-agent-7.78 +2 | 7.78.4-r15 | — |
| Wolfi rolling | datadog-agent-7.80 +2 | 7.80.4-r4 | — |
| Wolfi rolling | fluent-bit-plugin-loki | 3.7.3-r2 | — |
| Wolfi rolling | grafana-12.3 | 12.3.8-r3 | — |
| Wolfi rolling | grafana-12.4 | 12.4.5-r4 | — |
| Wolfi rolling | grafana-13.0 | 13.0.3-r3 | — |
| Wolfi rolling | istio-install-cni-1.30-compat | 1.30.4-r2 | — |
| Wolfi rolling | istioctl-1.29 +1 | 1.29.3-r1 | — |
| Wolfi rolling | istioctl-1.30 +1 | 1.30.2-r1 | — |
| Wolfi rolling | jaeger-2 +1 | 2.21.0-r0 | — |
| Wolfi rolling | jaeger-2-jaeger | 2.19.0-r2 | — |
| Wolfi rolling | k8sgpt | 0.4.36-r1 | — |
| Wolfi rolling | karma | 0.131-r4 | — |
| Wolfi rolling | keda-2.19 +1 | 2.19.0-r20 | — |
| Wolfi rolling | keda-2.20 +1 | 2.20.1-r1 | — |
| Wolfi rolling | loki-3.6 +3 | 3.6.12-r1 | — |
| Wolfi rolling | mc | 0.20250813.083541-r16 | — |
| Wolfi rolling | metrics-server | 0.8.1-r15 | — |
| Wolfi rolling | metrics-server-compat | 0.9.0-r11 | — |
| Wolfi rolling | minio | 0.20260520.234452-r0 | — |
| Wolfi rolling | minio-operator +1 | 7.1.1-r28 | — |
| Wolfi rolling | minio-operator-compat | 7.1.1-r33 | — |
| Wolfi rolling | node-problem-detector-1.35 | 1.35.2-r12 | — |
| Wolfi rolling | node-problem-detector-1.36 | 1.36.0-r0 | — |
| Wolfi rolling | opentelemetry-collector | 0.156.0-r1 | — |
| Wolfi rolling | prometheus-3.11 | 3.11.3-r5 | — |
| Wolfi rolling | prometheus-3.12 | 3.12.0-r0 | — |
| Wolfi rolling | prometheus-operator +2 | 0.92.1-r2 | — |
| Wolfi rolling | prometheus-operator-iamguarded-compat | 0.94.0-r0 | — |
| Wolfi rolling | prometheus-pushgateway | 1.11.3-r2 | — |
| Wolfi rolling | splunk-otel-collector | 0.156.0-r0 | — |
| Wolfi rolling | splunk-otel-collector-compat | 0.160.0-r0 | — |
| Wolfi rolling | tempo-2.10 +2 | 2.10.7-r3 | — |
| Wolfi rolling | trillian-logserver +1 | 1.7.3-r10 | — |
Public exploits
Exploit or proof-of-concept code for this vulnerability is publicly available, which lowers the bar for attackers. Treat it as a reason to patch sooner.
Third-party code, not reviewed by us. Public PoCs are sometimes fake or contain malware. Read the code first and run it only in an isolated lab, against systems you are authorised to test.
GitHub 1 repository
-
ShadowByte1/CVE-2026-42154 ★ 0 · May 15, 2026
# CVE-2026-42154 — Prometheus Remote Read Snappy DoS
Sources: PoC-in-GitHub, Metasploit Framework, Exploit-DB — updated daily. Only links are listed; no exploit code is hosted here.
Affected packages
| Ecosystem | Package | Affected | Fixed | Record |
|---|---|---|---|---|
| Go | github.com/prometheus/prometheus | >= 0.306.0, < 0.311.3 | 0.311.3 | GHSA-8rm2-7qqf-34qm |
| Go | github.com/prometheus/prometheus | < 0.305.2 | 0.305.2 | GHSA-8rm2-7qqf-34qm |
| Go | github.com/prometheus/prometheus | >= 1.0.0-rc.0, <= 2.5.0 | — | GHSA-8rm2-7qqf-34qm |
| Go | github.com/prometheus/prometheus | < 0.305.2 · >= 0.306.0, < 0.311.3 · >= 1.0.0-rc.0 | 0.305.2, 0.311.3 | GO-2026-5264 |
| Go | github.com/prometheus/prometheus/v2 | all versions | — | GO-2026-5264 |
Advisories 22
- WID-SEC-2026-1292 Prometheus: Mehrere Schwachstellen BSI CERT-Bund (WID) · Nov 12, 2026
- WID-SEC-2026-3046 IBM Concert: Mehrere Schwachstellen BSI CERT-Bund (WID) · Nov 10, 2026
- ALSA-2026:34359 Important: opentelemetry-collector security update AlmaLinux Security Advisories · Oct 29, 2026
- ALSA-2026:34357 Important: opentelemetry-collector security update AlmaLinux Security Advisories · Oct 29, 2026
- RHSA-2026:53415 Red Hat Security Advisory: opentelemetry-collector security update Red Hat Security Advisories (RHSA) · Oct 20, 2026
- RHSA-2026:53413 Red Hat Security Advisory: opentelemetry-collector security update Red Hat Security Advisories (RHSA) · Oct 20, 2026
- RHSA-2026:53412 Red Hat Security Advisory: opentelemetry-collector security update Red Hat Security Advisories (RHSA) · Oct 20, 2026
- RHSA-2026:41019 Red Hat Security Advisory: Red Hat Edge Manager Version 1.1.3 Security Update Red Hat Security Advisories (RHSA) · Oct 20, 2026
- RHSA-2026:36796 Red Hat Security Advisory: Red Hat Edge Manager Version 1.0.3 Security Update Red Hat Security Advisories (RHSA) · Oct 20, 2026
- RHSA-2026:34359 Red Hat Security Advisory: opentelemetry-collector security update Red Hat Security Advisories (RHSA) · Oct 20, 2026
- RHSA-2026:34357 Red Hat Security Advisory: opentelemetry-collector security update Red Hat Security Advisories (RHSA) · Oct 20, 2026
- RHSA-2026:29770 Red Hat Security Advisory: Red Hat Hardened Images RPMs bug fix and enhancement update Red Hat Security Advisories (RHSA) · Oct 20, 2026
- RHSA-2026:25039 Red Hat Security Advisory: Red Hat Hardened Images RPMs bug fix and enhancement update Red Hat Security Advisories (RHSA) · Oct 17, 2026
- RHSA-2026:25245 Red Hat Security Advisory: Red Hat Hardened Images RPMs bug fix and enhancement update Red Hat Security Advisories (RHSA) · Oct 16, 2026
- openSUSE-SU-2026:21483-1 Security update for govulncheck-vulndb SUSE / openSUSE Security Updates · Jul 31, 2026
- RLSA-2026:34357 Important: opentelemetry-collector security update Rocky Linux Security Advisories · Jul 7, 2026
- SUSE-SU-2026:2774-1 Security update 5.1.4 for Multi-Linux Manager Server SUSE / openSUSE Security Updates · Jul 7, 2026
- SUSE-SU-2026:2768-1 Security update 5.1.4 for Multi-Linux Manager Client Tools SUSE / openSUSE Security Updates · Jul 7, 2026
- ALAS2023-2026-1747 Important: amazon-cloudwatch-agent security update (Amazon Linux 2023) Amazon Linux Security Center (ALAS) · Jul 6, 2026
- ALAS2-2026-3323 Important: amazon-cloudwatch-agent security update (Amazon Linux 2) Amazon Linux Security Center (ALAS) · Jul 6, 2026
- RLSA-2026:34359 Important: opentelemetry-collector security update Rocky Linux Security Advisories · Jul 5, 2026
- openSUSE-SU-2026:10676-1 golang-github-prometheus-prometheus-3.11.3-1.1 on GA media SUSE / openSUSE Security Updates · May 5, 2026
References
- https://github.com/prometheus/prometheus/security/advisories/GHSA-8rm2-7qqf-34qm
- https://github.com/prometheus/prometheus/pull/18584
- https://github.com/prometheus/prometheus/pull/18585
- https://github.com/prometheus/prometheus/releases/tag/v3.11.3
- https://github.com/prometheus/prometheus/releases/tag/v3.5.3