VYPR
← All advisories
High severityNVD Advisory· Published Feb 15, 2022· Updated Apr 23, 2025

Uncontrolled Resource Consumption in promhttp

CVE-2022-21698

Description

client_golang is the instrumentation library for Go applications in Prometheus, and the promhttp package in client_golang provides tooling around HTTP servers and clients. In client_golang prior to version 1.11.1, HTTP server is susceptible to a Denial of Service through unbounded cardinality, and potential memory exhaustion, when handling requests with non-standard HTTP methods. In order to be affected, an instrumented software must use any of promhttp.InstrumentHandler* middleware except RequestsInFlight; not filter any specific methods (e.g GET) before middleware; pass metric with method label name to our middleware; and not have any firewall/LB/proxy that filters away requests with unknown method. client_golang version 1.11.1 contains a patch for this issue. Several workarounds are available, including removing the method label name from counter/gauge used in the InstrumentHandler; turning off affected promhttp handlers; adding custom middleware before promhttp handler that will sanitize the request method given by Go http.Request; and using a reverse proxy or web application firewall, configured to only allow a limited set of methods.

AI Insight

LLM-synthesized narrative grounded in this CVE's description and references.

Prometheus client_golang promhttp handlers allow unbounded cardinality leading to DoS via crafted HTTP methods.

Vulnerability

In client_golang prior to version 1.11.1, the promhttp package's instrumentation middleware (InstrumentHandler* except RequestsInFlight) does not validate the HTTP method label value. An attacker can send requests with arbitrary, non-standard HTTP methods, causing the creation of an unbounded number of time series in the method label dimension. This leads to unbounded cardinality and potential memory exhaustion, resulting in a Denial of Service (DoS) [1][2][3]. Affected versions are those before 1.11.1.

Exploitation

No authentication or special network position is required; the attacker only needs to send HTTP requests to an instrumented endpoint. The target must be using one of the affected promhttp.InstrumentHandler* middleware, must not filter HTTP methods before the middleware, must pass a metric with a method label to the middleware, and must not have a firewall, load balancer, or proxy that blocks unknown HTTP methods. The attacker sends a series of requests with unique, crafted non-standard methods (e.g., arbitrary strings) to exhaust server memory [3].

Impact

Successful exploitation results in memory exhaustion and Denial of Service, making the instrumented HTTP server unavailable. There is no direct impact on confidentiality or integrity in terms of data exposure or modification; the primary impact is availability [3].

Mitigation

The fix is included in client_golang version 1.11.1, released on 2022-02-15 [3][4]. Several workarounds exist: remove the method label from the counter or gauge used in the InstrumentHandler; disable the affected handlers; add custom middleware before the promhttp handler to sanitize the request method; or deploy a reverse proxy or web application firewall configured to allow only standard HTTP methods [1][3].

References
  1. promhttp: Check validity of method and code label values (#962) by bwplotka · Pull Request #987 · prometheus/client_golang
  2. promhttp: Check validity of method and code label values by kakkoyun · Pull Request #962 · prometheus/client_golang
  3. NVD - CVE-2022-21698
  4. Release 1.11.1 / 2022-02-15 · prometheus/client_golang

AI Insight generated on May 21, 2026. Synthesized from this CVE's description and the cited reference URLs; citations are validated against the source bundle.

Affected packages

Versions sourced from the GitHub Security Advisory.

PackageAffected versionsPatched versions
github.com/prometheus/client_golangGo
< 1.11.11.11.1

Affected products

175

Patches

0

No patches discovered yet.

Vulnerability mechanics

AI mechanics synthesis has not run for this CVE yet.

References

43

News mentions

0

No linked articles in our index yet.