3.16.0-rc.2 / 2026-10-27
2026-10-29T08:51:31Z•3b937f4a9ab0fa091a8084f3ab5dd085dd88f7dfbf5b5ae85ea00da792cb3c88
CA-certificatesCVE-not-specifiedGoHTTP/2OpenTelemetryPrometheusTLSdependency-updategRPCgolang.org/x/netinformation-disclosurememory-exhaustionsecurity-update
What happened
Prometheus releases include multiple security updates. Versions 3.15.1 and 3.13.5 update Go to address vulnerabilities in net/http, net/textproto, crypto/tls, and html/template; upgrade golang.org/x/net to fix several HTTP/2 vulnerabilities; and update container CA trust following compromised eMudhra intermediate CA keys. Version 3.13.5 also updates OpenTelemetry to prevent exporter endpoint URLs from leaking into info logs. Version 3.13.4 fixes an HTTP/2 DATA frame fragmentation memory-exhaustion issue through a gRPC upgrade and updates vulnerable UI npm dependencies. The affected release may
Why it matters
A reviewed impact interpretation has not been published for this record.
Evidence and limitations
- Source ID
- prometheus_prometheus_releases
- Record identifier
- 3b937f4a9ab0fa091a8084f3ab5dd085dd88f7dfbf5b5ae85ea00da792cb3c88
- Enrichment time
- 2026-10-29T08:51:31Z
- AI-assisted enrichment
- Yes
This record may overlap with other records. Its enrichment can be incomplete or wrong, and machine assistance was used. Validate consequential decisions against the linked source and your own environment.