3.16.0-rc.4 / 2026-11-03
2026-11-04T08:51:33Z•4dcab4621edd51bdf20d9270615d3820c8d764c959f2bcd3882ff30c14bfccc3
GoHTTP/2OpenTelemetryPrometheusTLScertificate-authority-compromisecontainer-imagesgolang.org/x/netinformation-disclosurerelease-candidatesecurity-release
What happened
Prometheus releases 3.15.1 and 3.13.5 address multiple security issues: HTTP/2 vulnerabilities in golang.org/x/net, vulnerabilities in Go net/http, net/textproto, crypto/tls, and html/template, compromised eMudhra/Comodo certificate trust chains, and an OpenTelemetry issue that could leak exporter endpoint URLs into logs. The document also includes 3.16.0 release candidates with API, TLS configuration, PromQL, and remote-write changes. Upgrade to the applicable patched release and review container trust stores and logged telemetry endpoints.
Why it matters
A reviewed impact interpretation has not been published for this record.
Evidence and limitations
- Source ID
- prometheus_prometheus_releases
- Record identifier
- 4dcab4621edd51bdf20d9270615d3820c8d764c959f2bcd3882ff30c14bfccc3
- Enrichment time
- 2026-11-04T08:51:33Z
- AI-assisted enrichment
- Yes
This record may overlap with other records. Its enrichment can be incomplete or wrong, and machine assistance was used. Validate consequential decisions against the linked source and your own environment.