High severity7.5NVD Advisory· Published May 4, 2026· Updated May 11, 2026
CVE-2026-42154
CVE-2026-42154
Description
Prometheus is an open-source monitoring system and time series database. Prior to versions 3.5.3 and 3.11.3, the remote read endpoint (/api/v1/read) does not validate the declared decoded length in a snappy-compressed request body before allocating memory. An unauthenticated attacker can send a small payload that causes a huge heap allocation per request. Under concurrent load this can exhaust available memory and crash the Prometheus process. This issue has been patched in versions 3.5.3 and 3.11.3.
AI Insight
LLM-synthesized narrative grounded in this CVE's description and references.
Affected packages
Versions sourced from the GitHub Security Advisory.
| Package | Affected versions | Patched versions |
|---|---|---|
github.com/prometheus/prometheusGo | >= 0.306.0, < 0.311.3 | 0.311.3 |
github.com/prometheus/prometheusGo | < 0.305.2 | 0.305.2 |
github.com/prometheus/prometheusGo | >= 1.0.0-rc.0, <= 2.5.0 | — |
Affected products
25(expand)+ 1 more
- (no CPE)
- cpe:2.3:a:prometheus:prometheus:*:*:*:*:*:*:*:*range: <3.5.3
- osv-coords23 versionspkg:apk/chainguard/istioctl-1.28pkg:apk/chainguard/istio-pilot-discovery-1.28pkg:apk/chainguard/istio-pilot-discovery-fips-1.28pkg:apk/chainguard/ld-relaypkg:apk/chainguard/ld-relay-fipspkg:apk/chainguard/miniopkg:apk/chainguard/minio-fipspkg:apk/chainguard/plutonopkg:apk/chainguard/plutono-fipspkg:apk/chainguard/prometheus-3.11pkg:apk/chainguard/prometheus-3.12pkg:apk/chainguard/prometheus-3.5pkg:apk/chainguard/prometheus-fips-3.11pkg:apk/chainguard/prometheus-fips-3.5pkg:apk/wolfi/istioctl-1.28pkg:apk/wolfi/istio-pilot-discovery-1.28pkg:apk/wolfi/miniopkg:apk/wolfi/prometheus-3.11pkg:apk/wolfi/prometheus-3.12pkg:apk/wolfi/prometheus-3.5pkg:bitnami/prometheuspkg:golang/github.com/prometheus/prometheuspkg:rpm/opensuse/golang-github-prometheus-prometheus&distro=openSUSE%20Tumbleweed
< 0+ 22 more
- (no CPE)range: < 0
- (no CPE)range: < 0
- (no CPE)range: < 0
- (no CPE)range: < 8.19.3-r0
- (no CPE)range: < 8.19.3-r0
- (no CPE)range: < 0.20260520.234452-r0
- (no CPE)range: < 0.20260520.234452-r0
- (no CPE)range: < 0
- (no CPE)range: < 0
- (no CPE)range: < 3.11.3-r5
- (no CPE)range: < 3.12.0-r0
- (no CPE)range: < 3.5.3-r1
- (no CPE)range: < 3.11.3-r3
- (no CPE)range: < 3.5.3-r3
- (no CPE)range: < 0
- (no CPE)range: < 0
- (no CPE)range: < 0.20260520.234452-r0
- (no CPE)range: < 3.11.3-r5
- (no CPE)range: < 3.12.0-r0
- (no CPE)range: < 3.5.3-r1
- (no CPE)range: < 3.5.3
- (no CPE)range: < 0.311.3
- (no CPE)range: < 3.11.3-1.1
Patches
Vulnerability mechanics
References
7- github.com/prometheus/prometheus/pull/18584nvdIssue TrackingPatchWEB
- github.com/prometheus/prometheus/pull/18585nvdIssue TrackingPatchWEB
- github.com/advisories/GHSA-8rm2-7qqf-34qmghsaADVISORY
- github.com/prometheus/prometheus/security/advisories/GHSA-8rm2-7qqf-34qmnvdVendor AdvisoryWEB
- nvd.nist.gov/vuln/detail/CVE-2026-42154ghsaADVISORY
- github.com/prometheus/prometheus/releases/tag/v3.11.3nvdRelease NotesWEB
- github.com/prometheus/prometheus/releases/tag/v3.5.3nvdRelease NotesWEB
News mentions
1- Patch Tuesday - May 2026Rapid7 Blog · May 13, 2026