3.13.3 / 2026-09-07
2026-09-08T08:51:31Z•37592f89f2d6a0a27be897699d61c76b33a04a5ee1239e759d348e6c5a16bd64
CVE-2026-56852CPU exhaustionDocker SwarmGoPromQLPrometheusdenial of servicedependency updategolang.org/x/cryptogolang.org/x/textgoogle.golang.org/grpcklauspost/compressreleasesecurity update
What happened
Prometheus 3.13.3, released September 7, 2026, includes security dependency updates for github.com/klauspost/compress (GO-2026-5841) and golang.org/x/crypto (GO-2026-6303). The release also fixes Docker Swarm service-discovery panics, PromQL case-insensitive regex matcher errors, and shutdown-related 100% CPU conditions. Prometheus 3.13.2 separately updated golang.org/x/text for CVE-2026-56852 and google.golang.org/grpc for GHSA-hrxh-6v49-42gf.
Why it matters
A reviewed impact interpretation has not been published for this record.
Evidence and limitations
- Source ID
- prometheus_prometheus_releases
- Record identifier
- 37592f89f2d6a0a27be897699d61c76b33a04a5ee1239e759d348e6c5a16bd64
- Enrichment time
- 2026-09-08T08:51:31Z
- AI-assisted enrichment
- Yes
This record may overlap with other records. Its enrichment can be incomplete or wrong, and machine assistance was used. Validate consequential decisions against the linked source and your own environment.