CVE-2026-42154: Prometheus: remote read endpoint allows denial of service via crafted snappy payload
Impact
The remote read endpoint (/api/v1/read) does not validate the declared decoded length in a snappy-compressed request body before allocating memory. An unauthenticated attacker can send a small payload that causes a huge heap allocation per request. Under concurrent load this can exhaust available memory and crash the Prometheus process.
Patches Has the problem been patched? What versions should users upgrade to?
Fixed in 3.11.3 and 3.5.3 LTS. Users should upgrade to these versions or later.
Workarounds User who can not upgrade can place Prometheus behind a reverse proxy or firewall that requires authentication before requests reach /api/v1/read.
Other sources
Prometheus is an open-source monitoring system and time series database. Prior to versions 3.5.3 and 3.11.3, the remote read endpoint (/api/v1/read) does not validate the declared decoded length in a snappy-compressed request body before allocating memory. An unauthenticated attacker can send a small payload that causes a huge heap allocation per request. Under concurrent load this can exhaust available memory and crash the Prometheus process. This issue has been patched in versions 3.5.3 and 3.11.3.
— MITRE
Prometheus: remote read endpoint allows denial of service via crafted snappy payload
— Microsoft
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
go/github.com/prometheus/prometheusto a version that resolves this vulnerability.Fixed in 0.311.3 - Upgrade
Upgrade
Prometheusto a version that resolves this vulnerability.Fixed in 3.5.3 - Upgrade
Upgrade
Prometheusto a version that resolves this vulnerability.Fixed in 3.11.3 - Compensating control
If you cannot upgrade, place Prometheus behind a reverse proxy or firewall that requires authentication before allowing requests to reach /api/v1/read.
Event History
Frequently Asked Questions
What is the severity of CVE-2026-42154?
CVE-2026-42154 has a significant severity rating as it allows for potential denial of service through crafted snappy payloads.
How do I fix CVE-2026-42154?
To fix CVE-2026-42154, upgrade Prometheus to version 3.5.3 or 3.11.3 or later.
What is the impact of CVE-2026-42154?
The impact of CVE-2026-42154 is that it can lead to denial of service when the remote read endpoint handles malformed payloads.
Which versions of Prometheus are affected by CVE-2026-42154?
Versions of Prometheus prior to 3.5.3 and 3.11.3 are affected by CVE-2026-42154.
Can CVE-2026-42154 be exploited remotely?
Yes, CVE-2026-42154 can be exploited remotely through the remote read endpoint without proper validation.