CVE-2026-42154
HighCVSS 7.5Exploitation Probability (EPSS)
Elevated risk55th percentile - higher than 55% of all known CVEs
Summary
Prometheus before versions 3.5.3 and 3.11.3 does not validate the declared decoded length in a snappy-compressed request to the /api/v1/read endpoint before allocating memory. An unauthenticated attacker can send a small payload causing a huge heap allocation, potentially exhausting memory and crashing the Prometheus process under concurrent load.
Risk Assessment
An attacker can cause a denial of service (DoS) by exhausting memory, disrupting system monitoring.
Recommendation
Upgrade Prometheus to version 3.5.3 or 3.11.3.
Other vulnerabilities in Prometheus
See all- CVE-2026-40179Medium
Prometheus versions 3.0 through 3.5.1 and 3.6.0 through 3.11.1 contain stored cross-site scripting vulnerabilities in the web UI where metric names and label values are injected into innerHTML without escaping. Because Prometheus v3.x defaults to UTF-8 validation allowing characters like <, >, and " in metric and label names, an attacker who can inject metrics via a compromised scrape target, remote write, or OTLP receiver can execute arbitrary JavaScript in the browser of any user viewing the metric in the Graph UI. The issue is fixed in versions 3.5.2 and 3.11.2.
- CVE-2026-119566Medium
Prometheus through 3.15.1 contains a credential leak vulnerability that allows attackers to capture Azure AD or Google IAM bearer tokens by redirecting remote_write requests to another host. Attackers controlling the remote-write endpoint or a redirecting server can return a 3xx to their host and replay the token, for example to write metrics to the victim's backend.
- CVE-2026-44903Medium
Prometheus from version 2.49.0 to before 3.5.3 and 3.11.3 contains an XSS vulnerability in the legacy web UI (enabled via --enable-feature=old-ui). In the histogram heatmap chart view, 'le' label values are not properly escaped, allowing an attacker to inject JavaScript via crafted metrics.
- CVE-2026-42151High
Prometheus prior to versions 3.5.3 and 3.11.3 stores the client_secret field in Azure AD OAuth configuration as a plain string instead of a Secret. This exposes the Azure OAuth client secret in plaintext to any user or process with access to the /-/config endpoint.
Original NVD description (English source)
Prometheus is an open-source monitoring system and time series database. Prior to versions 3.5.3 and 3.11.3, the remote read endpoint (/api/v1/read) does not validate the declared decoded length in a snappy-compressed request body before allocating memory. An unauthenticated attacker can send a small payload that causes a huge heap allocation per request. Under concurrent load this can exhaust available memory and crash the Prometheus process. This issue has been patched in versions 3.5.3 and 3.11.3.
Vulnerability data from NVD (NIST) · CISA KEV · EPSS