7.5
High
CVE-2026-42154 Prometheus is an open-source monitoring system and time series database
Description
Prometheus is an open-source monitoring system and time series database. Prior to versions 3.5.3 and 3.11.3, the remote read endpoint (/api/v1/read) does not validate the declared decoded length in a snappy-compressed request body before allocating memory. An unauthenticated attacker can send a small payload that causes a huge heap allocation per request. Under concurrent load this can exhaust available memory and crash the Prometheus process. This issue has been patched in versions 3.5.3 and 3.11.3.
Affected products and versions
| Product | Affected versions | Fixed in |
|---|---|---|
| prometheus 3.6 | 3.6.0 → < 3.11.3 | 3.11.3 |
| prometheus 3.5 | earliest → < 3.5.3 | 3.5.3 |
| Red Hat Advanced Cluster Management for Kubernetes 2.13 1782374537 | earliest → < 1782374537 | 1782374537 |
| Red Hat Hardened Images | Versions not published | |
| File Integrity Operator | Versions not published | |
| Logging Subsystem for Red Hat OpenShift | Versions not published | |
| Multicluster Global Hub | Versions not published | |
| Network Observability Operator | Versions not published | |
| OpenShift Lightspeed | Versions not published |
Show the 79 other branches Hide the 79 other branches
| Product | Affected versions | Fixed in |
|---|---|---|
| Red Hat Advanced Cluster Management for Kubernetes 2 | Versions not published | |
| Red Hat Ceph Storage 5 | Versions not published | |
| Red Hat Ceph Storage 6 | Versions not published | |
| Red Hat Ceph Storage 7 | Versions not published | |
| Red Hat Ceph Storage 8 | Versions not published | |
| Red Hat Ceph Storage 9 | Versions not published | |
| Red Hat Edge Manager 1 | Versions not published | |
| Red Hat Enterprise Linux 10 | Versions not published | |
| Red Hat Enterprise Linux 7 | Versions not published | |
| Red Hat Enterprise Linux 8 | Versions not published | |
| Red Hat Enterprise Linux 9 | Versions not published | |
| Red Hat OpenShift AI (RHOAI) | Versions not published | |
| Red Hat OpenShift Container Platform 4 | Versions not published | |
| Red Hat OpenShift GitOps | Versions not published | |
| Red Hat Quay 3 | Versions not published | |
| Red Hat Trusted Artifact Signer | Versions not published | |
| OpenShift Service Mesh 2 | Versions not published | |
| OpenShift Service Mesh 3 | Versions not published | |
| Red Hat OpenStack Platform 18.0 | Versions not published | |
| Red Hat Enterprise Linux AppStream (v. 10) | Versions not published | |
| Red Hat Enterprise Linux AppStream (v. 9) | Versions not published | |
| Logging Subsystem for Red Hat OpenShift 6.4 1782405469 | earliest → < 1782405469 | 1782405469 |
| RHEM 1.0 for RHEL 9 | Versions not published | |
| Red Hat Edge Manager 1.0 1783502445 | earliest → < 1783502445 | 1783502445 |
| Red Hat OpenShift Container Platform 4.22 1782859326 | earliest → < 1782859326 | 1782859326 |
| Red Hat Edge Manager 1.1 1784127775 | earliest → < 1784127775 | 1784127775 |
| Red Hat Quay 3.9 1784125838 | earliest → < 1784125838 | 1784125838 |
| Red Hat Trusted Artifact Signer 1.3 1783968861 | earliest → < 1783968861 | 1783968861 |
| RHEM 1.1 for RHEL 10 | Versions not published | |
| RHEM 1.1 for RHEL 9 | Versions not published | |
| Multicluster Global Hub 1.4.5 1784060681 | earliest → < 1784060681 | 1784060681 |
| Red Hat Quay 3.10 1783750447 | earliest → < 1783750447 | 1783750447 |
| Red Hat Quay 3.16 1783955846 | earliest → < 1783955846 | 1783955846 |
| Red Hat multicluster global hub 1.4.3 1784060681 | earliest → < 1784060681 | 1784060681 |
| Red Hat Quay 3.1 1783750447 | earliest → < 1783750447 | 1783750447 |
| Red Hat OpenShift Container Platform 4.21 1784053555 | earliest → < 1784053555 | 1784053555 |
| Red Hat Quay 3.12 1784353904 | earliest → < 1784353904 | 1784353904 |
| Red Hat Quay 3.12 1783751865 | earliest → < 1783751865 | 1783751865 |
| Multicluster Global Hub 1.5.6 1784562060 | earliest → < 1784562060 | 1784562060 |
| Red Hat Quay 3.15 1784351966 | earliest → < 1784351966 | 1784351966 |
| Multicluster Global Hub 1.6.4 1784561376 | earliest → < 1784561376 | 1784561376 |
| Logging for Red Hat OpenShift 6.4 1782405469 | earliest → < 1782405469 | 1782405469 |
| Multicluster Global Hub 1.6.2 1784561376 | earliest → < 1784561376 | 1784561376 |
| Red Hat multicluster global hub 1.5.0 1784562060 | earliest → < 1784562060 | 1784562060 |
| Multicluster Global Hub 1.7.2 1785442872 | earliest → < 1785442872 | 1785442872 |
| Multicluster Global Hub 1.7.2 1784906628 | earliest → < 1784906628 | 1784906628 |
| Red Hat OpenShift Container Platform 4.20 1784349713 | earliest → < 1784349713 | 1784349713 |
| Logging Subsystem for Red Hat OpenShift 6.2 1784747815 | earliest → < 1784747815 | 1784747815 |
| Red Hat OpenShift Container Platform 4.19 1784583836 | earliest → < 1784583836 | 1784583836 |
| Logging for Red Hat OpenShift 6.2 1784747815 | earliest → < 1784747815 | 1784747815 |
| Multicluster Global Hub 1.5.4 1784562060 | earliest → < 1784562060 | 1784562060 |
| Multicluster Global Hub 1.7.1 1784906628 | earliest → < 1784906628 | 1784906628 |
| Red Hat multicluster global hub 1.4.4 1784060681 | earliest → < 1784060681 | 1784060681 |
| Red Hat multicluster global hub 1.6.0 1784561376 | earliest → < 1784561376 | 1784561376 |
| Red Hat OpenShift Container Platform 4.2 1784349713 | earliest → < 1784349713 | 1784349713 |
| Logging Subsystem for Red Hat OpenShift 6.0 1785418852 | earliest → < 1785418852 | 1785418852 |
| Red Hat OpenShift Container Platform 4.17 1784828871 | earliest → < 1784828871 | 1784828871 |
| Red Hat OpenShift Container Platform 4.18 1785360067 | earliest → < 1785360067 | 1785360067 |
| Logging for Red Hat OpenShift 6.0 1785418852 | earliest → < 1785418852 | 1785418852 |
| Red Hat Enterprise Linux 10.0 Extended Update Support | Versions not published | |
| Red Hat Enterprise Linux 9.4 Update Services for SAP Solutions | Versions not published | |
| Red Hat Enterprise Linux 9.6 Extended Update Support | Versions not published | |
| Multicluster Global Hub 1.5.7 1784562060 | earliest → < 1784562060 | 1784562060 |
| Multicluster Global Hub 1.6.5 1784561376 | earliest → < 1784561376 | 1784561376 |
| OpenShift File Integrity Operator - FIO 1 1786439449 | earliest → < 1786439449 | 1786439449 |
| Red Hat OpenShift Container Platform 4.16 1785582559 | earliest → < 1785582559 | 1785582559 |
| File Integrity Operator 1 1786439449 | earliest → < 1786439449 | 1786439449 |
| Red Hat multicluster global hub 1.4.2 1784060681 | earliest → < 1784060681 | 1784060681 |
| Compliance Operator 1 1786439449 | earliest → < 1786439449 | 1786439449 |
| Red Hat multicluster global hub 1.5.1 1784562060 | earliest → < 1784562060 | 1784562060 |
| Logging Subsystem for Red Hat OpenShift 6.5 1786645109 | earliest → < 1786645109 | 1786645109 |
| Multicluster Global Hub 1.7.0 1785442872 | earliest → < 1785442872 | 1785442872 |
| Multicluster Global Hub 1.7.0 1784906628 | earliest → < 1784906628 | 1784906628 |
| Red Hat Advanced Cluster Management for Kubernetes 2.17 1787230287 | earliest → < 1787230287 | 1787230287 |
| Red Hat OpenShift Container Platform 4.14 1786999821 | earliest → < 1786999821 | 1786999821 |
| Red Hat OpenShift Container Platform 4.15 1786998274 | earliest → < 1786998274 | 1786998274 |
| Red Hat OpenShift Container Platform 4.12 1787343838 | earliest → < 1787343838 | 1787343838 |
| Red Hat multicluster global hub 1.5.3 1784562060 | earliest → < 1784562060 | 1784562060 |
| Logging for Red Hat OpenShift 6 1785418852 | earliest → < 1785418852 | 1785418852 |
References
- github.com github.com
- github.com github.com
- github.com github.com
- github.com github.com
- github.com github.com
Timeline
- Published
- Last modified
Other CVEs of prometheus
The 6 CVEs of prometheus →
CVE-2026-119566
Prometheus through 3.15.1 Credential Leak via remote_write Cross-Host Redirects
6.3
Medium
CVE-2026-44903
Prometheus is an open-source monitoring system and time series database
5.1
Medium
CVE-2026-42151
Prometheus is an open-source monitoring system and time series database
7.5
High
CVE-2026-40179
Prometheus is an open-source monitoring system and time series database
5.3
Medium