Memory Allocation Vulnerability in Prometheus Monitoring System
CVE-2026-42154
Key Information:
- Vendor
Prometheus
- Status
- Vendor
- CVE Published:
- 4 May 2026
Badges
What is CVE-2026-42154?
Prometheus, a widely used open-source monitoring system and time series database, had a vulnerability in its remote read endpoint (/api/v1/read) prior to versions 3.5.3 and 3.11.3. This issue stemmed from a lack of validation for the declared decoded length in snappy-compressed request bodies. As a result, an unauthenticated attacker could exploit this vulnerability by sending specially crafted small payloads, leading to excessive heap memory allocation. When subjected to high concurrent loads, this vulnerability posed a risk of exhausting available memory and subsequently crashing the Prometheus process. Patches have been implemented in the updated versions to mitigate this risk.
Affected Version(s)
prometheus < 3.5.3 < 3.5.3
prometheus >= 3.6.0, < 3.11.3 < 3.6.0, 3.11.3
Exploit Proof of Concept (PoC)
PoC code is written by security researchers to demonstrate the vulnerability can be exploited. PoC code is also a key component for weaponization which could lead to ransomware.