PT-2026-36897 · Unknown · Prometheus

Shadowbyte1 · Published 2026-05-04 · Updated 2026-05-25 · CVE-2026-42154

Positive Technologies (AI Summary)

CVSS v3.1

7.5

High

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

Name of the Vulnerable Software and Affected Versions Prometheus versions prior to 3.5.3 Prometheus versions prior to 3.11.3

Description Prometheus is an open-source monitoring system and time series database. The remote read endpoint "/api/v1/read" fails to validate the declared decoded length in a snappy-compressed request body before allocating memory. An unauthenticated attacker can send a small payload to trigger a large heap allocation per request, which can exhaust available memory and crash the process under concurrent load.

Recommendations Update to version 3.5.3. Update to version 3.11.3.

Fix

DoS

Resource Exhaustion

Weakness Enumeration

CWE-789

CWE-400

Related Identifiers

BIT-PROMETHEUS-2026-42154

CLEANSTART-2026-AP95632

CLEANSTART-2026-AX33738

CLEANSTART-2026-MV81821

CLEANSTART-2026-PM88731

CLEANSTART-2026-QS87161

CLEANSTART-2026-TL66481

CVE-2026-42154

GHSA-8RM2-7QQF-34QM

OPENSUSE-SU-2026:10676-1

Affected Products

Prometheus

References · 146

• https://github.com/prometheus/prometheus/pull/18584 · Patch
• https://github.com/prometheus/prometheus/pull/18585 · Patch
• https://github.com/prometheus/prometheus/security/advisories/GHSA-8rm2-7qqf-34qm · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2026-33186 · Security Note
• https://osv.dev/vulnerability/CLEANSTART-2026-MV81821 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2026-39819 · Security Note
• https://nvd.nist.gov/vuln/detail/CVE-2026-34986 · Security Note
• https://nvd.nist.gov/vuln/detail/CVE-2026-32952 · Security Note
• https://osv.dev/vulnerability/BIT-prometheus-2026-42154 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2026-27144 · Security Note
• https://nvd.nist.gov/vuln/detail/CVE-2026-40179 · Security Note
• https://nvd.nist.gov/vuln/detail/CVE-2026-42501 · Security Note
• https://osv.dev/vulnerability/DEBIAN-CVE-2026-42154 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2026-25679 · Security Note
• https://nvd.nist.gov/vuln/detail/CVE-2026-39820 · Security Note