3.15.1 / 2026-10-21
2026-10-22T08:51:31Z•52f8a282b57ccd5ad3643a02ed857c65c472325197ba85eb8e6300d58ff4e1eb
CA certificatesGo vulnerabilitiesHTTP/2OpenTelemetryPrometheusTLSeMudhragRPCinformation disclosurememory exhaustionnpm dependenciessecurity release
What happened
Prometheus releases 3.15.1 and 3.13.5 address multiple security issues, including Go standard-library vulnerabilities, HTTP/2 vulnerabilities in golang.org/x/net, compromised CA trust roots, and an OpenTelemetry exporter endpoint information leak. Prometheus 3.13.4 also updates gRPC to mitigate HTTP/2 DATA frame fragmentation memory exhaustion and refreshes vulnerable UI npm dependencies.
Why it matters
A reviewed impact interpretation has not been published for this record.
Evidence and limitations
- Source ID
- prometheus_prometheus_releases
- Record identifier
- 52f8a282b57ccd5ad3643a02ed857c65c472325197ba85eb8e6300d58ff4e1eb
- Enrichment time
- 2026-10-22T08:51:31Z
- AI-assisted enrichment
- Yes
This record may overlap with other records. Its enrichment can be incomplete or wrong, and machine assistance was used. Validate consequential decisions against the linked source and your own environment.