CVE-2026-42154
HighCVSS 7.5Exploitation Probability (EPSS)
Elevated risk55th percentile - higher than 55% of all known CVEs
Summary
Prometheus before versions 3.5.3 and 3.11.3 does not validate the declared decoded length in a snappy-compressed request to the /api/v1/read endpoint before allocating memory. An unauthenticated attacker can send a small payload causing a huge heap allocation, potentially exhausting memory and crashing the Prometheus process under concurrent load.
Risk Assessment
An attacker can cause a denial of service (DoS) by exhausting memory, disrupting system monitoring.
Recommendation
Upgrade Prometheus to version 3.5.3 or 3.11.3.
Other vulnerabilities in Prometheus
See all- CVE-2026-44903Medium
Prometheus from version 2.49.0 to before 3.5.3 and 3.11.3 contains an XSS vulnerability in the legacy web UI (enabled via --enable-feature=old-ui). In the histogram heatmap chart view, 'le' label values are not properly escaped, allowing an attacker to inject JavaScript via crafted metrics.
- CVE-2026-42151High
Prometheus prior to versions 3.5.3 and 3.11.3 stores the client_secret field in Azure AD OAuth configuration as a plain string instead of a Secret. This exposes the Azure OAuth client secret in plaintext to any user or process with access to the /-/config endpoint.
Original NVD description (English source)
Prometheus is an open-source monitoring system and time series database. Prior to versions 3.5.3 and 3.11.3, the remote read endpoint (/api/v1/read) does not validate the declared decoded length in a snappy-compressed request body before allocating memory. An unauthenticated attacker can send a small payload that causes a huge heap allocation per request. Under concurrent load this can exhaust available memory and crash the Prometheus process. This issue has been patched in versions 3.5.3 and 3.11.3.
Vulnerability data from NVD (NIST) · CISA KEV · EPSS