Memory Allocation Vulnerability in Prometheus Monitoring System

CVE-2026-42154

What is CVE-2026-42154?

Prometheus, a widely used open-source monitoring system and time series database, had a vulnerability in its remote read endpoint (/api/v1/read) prior to versions 3.5.3 and 3.11.3. This issue stemmed from a lack of validation for the declared decoded length in snappy-compressed request bodies. As a result, an unauthenticated attacker could exploit this vulnerability by sending specially crafted small payloads, leading to excessive heap memory allocation. When subjected to high concurrent loads, this vulnerability posed a risk of exhausting available memory and subsequently crashing the Prometheus process. Patches have been implemented in the updated versions to mitigate this risk.

References