CVE-2026-42154
HighCVSS 7.5Exploitation Probability (EPSS)
Elevated risk54th percentile - higher than 54% of all known CVEs
Summary
Prometheus before versions 3.5.3 and 3.11.3 does not validate the declared decoded length in a snappy-compressed request to the /api/v1/read endpoint before allocating memory. An unauthenticated attacker can send a small payload causing a huge heap allocation, potentially exhausting memory and crashing the Prometheus process under concurrent load.
Risk Assessment
An attacker can cause a denial of service (DoS) by exhausting memory, disrupting system monitoring.
Recommendation
Upgrade Prometheus to version 3.5.3 or 3.11.3.
Other vulnerabilities in Prometheus
See all- CVE-2026-44903Medium
Prometheus from version 2.49.0 to before 3.5.3 and 3.11.3 contains an XSS vulnerability in the legacy web UI (enabled via --enable-feature=old-ui). In the histogram heatmap chart view, 'le' label values are not properly escaped, allowing an attacker to inject JavaScript via crafted metrics.
- CVE-2026-42151High
Prometheus prior to versions 3.5.3 and 3.11.3 stores the client_secret field in Azure AD OAuth configuration as a plain string instead of a Secret. This exposes the Azure OAuth client secret in plaintext to any user or process with access to the /-/config endpoint.
Original NVD description (English source)
Prometheus is an open-source monitoring system and time series database. Prior to versions 3.5.3 and 3.11.3, the remote read endpoint (/api/v1/read) does not validate the declared decoded length in a snappy-compressed request body before allocating memory. An unauthenticated attacker can send a small payload that causes a huge heap allocation per request. Under concurrent load this can exhaust available memory and crash the Prometheus process. This issue has been patched in versions 3.5.3 and 3.11.3.