CVE-2026-42154

Name of the Vulnerable Software and Affected Versions Prometheus versions prior to 3.5.3 Prometheus versions prior to 3.11.3

Description Prometheus is an open-source monitoring system and time series database. The remote read endpoint "/api/v1/read" fails to validate the declared decoded length in a snappy-compressed request body before allocating memory. An unauthenticated attacker can send a small payload to trigger a large heap allocation per request, which can exhaust available memory and crash the process under concurrent load.

Recommendations Update to version 3.5.3. Update to version 3.11.3.