Go/github.com/prometheus/prometheus/v2 CVE-2026-42154: high 7.5, EPSS 0.81%

Prometheus: Remote read endpoint allows denial of service via crafted snappy payload in github.com/prometheus/prometheus

Action: No fix published. Pin and monitor.

Affected

Fixed versions

No fixed version in the source.

Sources

• osv: GO-2026-5264#Go/github.com/prometheus/prometheus/v2
• nvd: CVE-2026-42154
• https://github.com/prometheus/prometheus/security/advisories/GHSA-8rm2-7qqf-34qm
• https://github.com/prometheus/prometheus/pull/18584
• https://github.com/prometheus/prometheus/pull/18585
• https://github.com/prometheus/prometheus/releases/tag/v3.11.3
• https://github.com/prometheus/prometheus/releases/tag/v3.5.3

CVE-2026-42154 · published 2026-06-25T18:43:15Z · modified 2026-07-14T16:41:01.254644922Z · JSON