Junglewise Threat Intelligence

CVE-2026-42154: Prometheus denial of service via memory exhaustion in remote read endpoint

CVE-2026-42154 · Severity: high · CVSS 7.5 · Published 2026-05-04

Technologies: Prometheus. Vendors: Prometheus.

Executive brief

Prometheus, a widely used open-source monitoring and alerting system, is vulnerable to a denial-of-service attack. An attacker can send a specially crafted, small request to the system's data reading interface that forces the server to allocate massive amounts of memory. This can lead to memory exhaustion and cause the monitoring service to crash, potentially leaving infrastructure unmonitored.

Technical details

A resource exhaustion vulnerability exists in the Prometheus remote read endpoint (/api/v1/read). The component fails to validate the declared decoded length of snappy-compressed request bodies before performing memory allocation. An unauthenticated remote attacker can exploit this by sending a small, malicious payload that specifies a massive decoded size, leading to large heap allocations. Under concurrent load, this results in memory exhaustion and a process crash (DoS). The issue is addressed in versions 3.5.3 and 3.11.3 by implementing a decode limit.

Affected products

  • Prometheus Prometheus < 3.5.3, >= 3.6.0 < 3.11.3

Timeline

  • 2026-04-27: patched: Fixes merged and releases 3.5.3 and 3.11.3 published.
  • 2026-04-27: advisory: GitHub Security Advisory GHSA-8rm2-7qqf-34qm published.
  • 2026-05-04: disclosed: NVD publication date.

References

Related threats