https://db.gcve.eu Contains only the most 10 recent entries. http://www.rssboard.org/rss-specification python-feedgen en Sat, 03 Oct 2026 09:50:41 +0000 https://db.gcve.eu/vuln/ghsa-8rm2-7qqf-34qm <p><strong>Affected:</strong> Go: github.com/prometheus/prometheus</p> <p>### Impact</p> <p>The remote read endpoint (`/api/v1/read`) does not validate the declared decoded length in a snappy-compressed request body before allocating memory. An unauthenticated attacker can send a small payload that causes a huge heap allocation per request. Under concurrent load this can exhaust available memory and crash the Prometheus process.</p> <p>### Patches _Has the problem been patched? What versions should users upgrade to?_</p> <p>Fixed in 3.11.3 and 3.5.3 LTS. Users should upgrade to these versions or later.</p> <p>### Workarounds User who can not upgrade can place Prometheus behind a reverse proxy or firewall that requires authentication before requests reach /api/v1/read.</p> <p><strong>Affected:</strong> Go: github.com/prometheus/prometheus</p> <p>### Impact</p> <p>The remote read endpoint (`/api/v1/read`) does not validate the declared decoded length in a snappy-compressed request body before allocating memory. An unauthenticated attacker can send a small payload that causes a huge heap allocation per request. Under concurrent load this can exhaust available memory and crash the Prometheus process.</p> <p>### Patches _Has the problem been patched? What versions should users upgrade to?_</p> <p>Fixed in 3.11.3 and 3.5.3 LTS. Users should upgrade to these versions or later.</p> <p>### Workarounds User who can not upgrade can place Prometheus behind a reverse proxy or firewall that requires authentication before requests reach /api/v1/read.</p> https://db.gcve.eu/vuln/ghsa-8rm2-7qqf-34qm