Prometheus: remote read endpoint allows denial of service via crafted snappy payload (prometheus prometheus)

CVE-2026-42154

HIGH 7.5

At a glance

Source: NVD
EPSS: EPSS 0.81 % · percentile 57 (2026-10-31)
State: PUBLISHED
Published: 2026-05-04 18:13 UTC
Updated: 2026-09-10 12:04 UTC
Assigner: GitHub_M
NVD status: Modified

Search on…

Description

Prometheus is an open-source monitoring system and time series database. Prior to versions 3.5.3 and 3.11.3, the remote read endpoint (/api/v1/read) does not validate the declared decoded length in a snappy-compressed request body before allocating memory. An unauthenticated attacker can send a small payload that causes a huge heap allocation per request. Under concurrent load this can exhaust available memory and crash the Prometheus process. This issue has been patched in versions 3.5.3 and 3.11.3.

Weaknesses (CWE)

CWE-400 — Uncontrolled Resource Consumption
CWE-789 — Memory Allocation with Excessive Size Value
CWE-770 — Allocation of Resources Without Limits or Throttling

References

Scores

Version	Score	Vector	Scored by
CVSS 3.1	HIGH 7.5	CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H	GitHub_M
CVSS 3.1	HIGH 7.5	CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H	redhat-SADP
CVSS 3.1	HIGH 7.5	CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H	NVD · security-advisories@github.com (Secondary)
CVSS 3.1	HIGH 7.5	CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H	NVD · 0b0ca135-0b70-47e7-9f44-1890c2a1c46c (Secondary)

Advisories

GHSA-8rm2-7qqf-34qm — Prometheus: Remote read endpoint allows denial of service via crafted snappy payload
GO-2026-5264 — Prometheus: Remote read endpoint allows denial of service via crafted snappy payload in github.com/prometheus/prometheus

European references

ENISA EUVD · EUVD-2026-27091
GCVE · GCVE-0-2026-42154

CERT-FR advisories

CERTFR-2026-AVI-0608 — Multiples vulnérabilités dans Microsoft Azure Linux · cert.ssi.gouv.fr

Affected configurations (NVD CPE)

cpe:2.3:a:prometheus:prometheus:*:*:*:*:*:*:*:* < 3.5.3
cpe:2.3:a:prometheus:prometheus:*:*:*:*:*:*:*:* ≥ 3.6.0 < 3.11.3

Affected products

Product	Versions
prometheus · prometheus	affected < 3.5.3 ; affected >= 3.6.0, < 3.11.3

Sources

Source	Licence
CVE List (CVEProject cvelistV5)	CVE Program Terms of Use
EPSS (FIRST.org)	FIRST — attribution requested
ENISA EUVD	ENISA — reproduction authorised, source acknowledged
CERT-FR (ANSSI)	Licence Ouverte / Etalab 2.0
NVD (NIST) via fkie-cad/nvd-json-data-feeds	Public domain — this product uses data from the NVD API but is not endorsed or certified by the NVD

⚠️ Prometheus: remote read endpoint allows denial of service via crafted snappy payload (prometheus prometheus)