CVE-2026-42154

EUVD-2026-27091

04.05.2026, 19:16

Prometheus is an open-source monitoring system and time series database. Prior to versions 3.5.3 and 3.11.3, the remote read endpoint (/api/v1/read) does not validate the declared decoded length in a snappy-compressed request body before allocating memory. An unauthenticated attacker can send a small payload that causes a huge heap allocation per request. Under concurrent load this can exhaust available memory and crash the Prometheus process. This issue has been patched in versions 3.5.3 and 3.11.3.

Provider	Type	Base Score	Atk. Vector	Atk. Complexity	Priv. Required	Vector
NIST	Primary	7.5 HIGH	NETWORK	LOW	NONE	CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

Base Score

CVSS 3.x

EPSS Score

Percentile: 53.53%

Affected Products (NVD)

Vendor	Product	Version
prometheus	prometheus	𝑥 < 3.5.3
prometheus	prometheus	3.6.0 ≤ 𝑥 < 3.11.3

𝑥

= Vulnerable software versions

Early Detection

Affected products identified ahead of NVD analysis through intelligence sources.

Vendor	Product	Version	Source
Red Hat	Red Hat Enterprise Linux 10	0:0.152.1-1.el10_2 ≤ 𝑥 < *	ADP
Red Hat	Red Hat Enterprise Linux 9	0:0.152.1-1.el9_8 ≤ 𝑥 < *	ADP
Red Hat	RHEM 1.0 for RHEL 9	0:1.0.3-1.el9em ≤ 𝑥 < *	ADP
Red Hat	RHEM 1.1 for RHEL 10	0:1.1.3-1.el10em ≤ 𝑥 < *	ADP
Red Hat	RHEM 1.1 for RHEL 9	0:1.1.3-1.el9em ≤ 𝑥 < *	ADP
Red Hat	Logging for Red Hat OpenShift 6.2	1784747884 ≤ 𝑥 < *	ADP
Red Hat	Logging for Red Hat OpenShift 6.2	1784747816 ≤ 𝑥 < *	ADP
Red Hat	Logging for Red Hat OpenShift 6.2	1784747815 ≤ 𝑥 < *	ADP
Red Hat	Logging for Red Hat OpenShift 6.4	1782405469 ≤ 𝑥 < *	ADP
Red Hat	Logging Subsystem for Red Hat OpenShift 6.0	1785418915 ≤ 𝑥 < *	ADP
Red Hat	Logging Subsystem for Red Hat OpenShift 6.0	1785418855 ≤ 𝑥 < *	ADP
Red Hat	Logging Subsystem for Red Hat OpenShift 6.0	1785418852 ≤ 𝑥 < *	ADP
Red Hat	Multicluster Global Hub 1.5.4	1784562060 ≤ 𝑥 < *	ADP
Red Hat	Multicluster Global Hub 1.7.1	1784906628 ≤ 𝑥 < *	ADP
Red Hat	Red Hat Advanced Cluster Management for Kubernetes 2.13	1782374537 ≤ 𝑥 < *	ADP
Red Hat	Red Hat Edge Manager 1.0	1783502022 ≤ 𝑥 < *	ADP
Red Hat	Red Hat Edge Manager 1.0	1783502465 ≤ 𝑥 < *	ADP
Red Hat	Red Hat Edge Manager 1.0	1783502025 ≤ 𝑥 < *	ADP
Red Hat	Red Hat Edge Manager 1.0	1783502494 ≤ 𝑥 < *	ADP
Red Hat	Red Hat Edge Manager 1.0	1783502401 ≤ 𝑥 < *	ADP
Red Hat	Red Hat Edge Manager 1.0	1783502403 ≤ 𝑥 < *	ADP
Red Hat	Red Hat Edge Manager 1.0	1783502022 ≤ 𝑥 < *	ADP
Red Hat	Red Hat Edge Manager 1.0	1783502023 ≤ 𝑥 < *	ADP
Red Hat	Red Hat Edge Manager 1.0	1783502029 ≤ 𝑥 < *	ADP
Red Hat	Red Hat Edge Manager 1.0	1783502445 ≤ 𝑥 < *	ADP
Red Hat	Red Hat Edge Manager 1.1	1784194638 ≤ 𝑥 < *	ADP
Red Hat	Red Hat Edge Manager 1.1	1784194353 ≤ 𝑥 < *	ADP
Red Hat	Red Hat Edge Manager 1.1	1784196588 ≤ 𝑥 < *	ADP
Red Hat	Red Hat Edge Manager 1.1	1784195620 ≤ 𝑥 < *	ADP
Red Hat	Red Hat Edge Manager 1.1	1784194309 ≤ 𝑥 < *	ADP
Red Hat	Red Hat Edge Manager 1.1	1784194144 ≤ 𝑥 < *	ADP
Red Hat	Red Hat Edge Manager 1.1	1784194188 ≤ 𝑥 < *	ADP
Red Hat	Red Hat Edge Manager 1.1	1784194653 ≤ 𝑥 < *	ADP
Red Hat	Red Hat Edge Manager 1.1	1784194144 ≤ 𝑥 < *	ADP
Red Hat	Red Hat Edge Manager 1.1	1784194980 ≤ 𝑥 < *	ADP
Red Hat	Red Hat Edge Manager 1.1	1784194347 ≤ 𝑥 < *	ADP
Red Hat	Red Hat Edge Manager 1.1	1784194971 ≤ 𝑥 < *	ADP
Red Hat	Red Hat Edge Manager 1.1	1784128388 ≤ 𝑥 < *	ADP
Red Hat	Red Hat Edge Manager 1.1	1784128860 ≤ 𝑥 < *	ADP
Red Hat	Red Hat Edge Manager 1.1	1784126780 ≤ 𝑥 < *	ADP
Red Hat	Red Hat Edge Manager 1.1	1784127787 ≤ 𝑥 < *	ADP
Red Hat	Red Hat Edge Manager 1.1	1784126762 ≤ 𝑥 < *	ADP
Red Hat	Red Hat Edge Manager 1.1	1784127762 ≤ 𝑥 < *	ADP
Red Hat	Red Hat Edge Manager 1.1	1784126832 ≤ 𝑥 < *	ADP
Red Hat	Red Hat Edge Manager 1.1	1784126774 ≤ 𝑥 < *	ADP
Red Hat	Red Hat Edge Manager 1.1	1784127791 ≤ 𝑥 < *	ADP
Red Hat	Red Hat Edge Manager 1.1	1784127135 ≤ 𝑥 < *	ADP
Red Hat	Red Hat Edge Manager 1.1	1784126733 ≤ 𝑥 < *	ADP
Red Hat	Red Hat Edge Manager 1.1	1784127775 ≤ 𝑥 < *	ADP
Red Hat	Red Hat Hardened Images	2.19.0-1.hum1 ≤ 𝑥 < *	ADP
Red Hat	Red Hat Hardened Images	0.153.0-1.hum1 ≤ 𝑥 < *	ADP
Red Hat	Red Hat Hardened Images	0.155.0-0.1.hum1 ≤ 𝑥 < *	ADP
Red Hat	Red Hat multicluster global hub 1.4.4	1784060681 ≤ 𝑥 < *	ADP
Red Hat	Red Hat multicluster global hub 1.6.0	1784561376 ≤ 𝑥 < *	ADP
Red Hat	Red Hat OpenShift Container Platform 4.17	1784828871 ≤ 𝑥 < *	ADP
Red Hat	Red Hat OpenShift Container Platform 4.18	1785360067 ≤ 𝑥 < *	ADP
Red Hat	Red Hat OpenShift Container Platform 4.19	1784583836 ≤ 𝑥 < *	ADP
Red Hat	Red Hat OpenShift Container Platform 4.20	1784349713 ≤ 𝑥 < *	ADP
Red Hat	Red Hat OpenShift Container Platform 4.21	1784053555 ≤ 𝑥 < *	ADP
Red Hat	Red Hat OpenShift Container Platform 4.22	1782859326 ≤ 𝑥 < *	ADP
Red Hat	Red Hat Quay 3.1	1783750447 ≤ 𝑥 < *	ADP
Red Hat	Red Hat Quay 3.12	1783751865 ≤ 𝑥 < *	ADP
Red Hat	Red Hat Quay 3.12	1784353904 ≤ 𝑥 < *	ADP
Red Hat	Red Hat Quay 3.15	1784351966 ≤ 𝑥 < *	ADP
Red Hat	Red Hat Quay 3.16	1783955846 ≤ 𝑥 < *	ADP
Red Hat	Red Hat Quay 3.9	1784125838 ≤ 𝑥 < *	ADP
Red Hat	Red Hat Trusted Artifact Signer 1.3	1783968861 ≤ 𝑥 < *	ADP
Red Hat	Red Hat Trusted Artifact Signer 1.3	1783968861 ≤ 𝑥 < *	ADP
Red Hat	Red Hat Trusted Artifact Signer 1.3	1783968468 ≤ 𝑥 < *	ADP
Red Hat	Red Hat Trusted Artifact Signer 1.3	1783960127 ≤ 𝑥 < *	ADP
Red Hat	Red Hat Trusted Artifact Signer 1.3	1783968861 ≤ 𝑥 < *	ADP
Red Hat	Red Hat Trusted Artifact Signer 1.3	1783968861 ≤ 𝑥 < *	ADP