3.13.4 / 2026-09-29

2026-10-03T08:51:30Z•87111e0ecf228da88bc08609bf2f98e8d055ab7aea822a71cc4f856a8f00e2b2

GoHTTP/2Prometheusdenial of servicedependency vulnerabilitygRPCgolang.org/x/cryptoklauspost/compressmemory exhaustionnpmreleasesecurity update

Open source link →

What happened

Prometheus releases 3.13.3 and 3.13.4 include security updates addressing dependency vulnerabilities. Version 3.13.4 upgrades google.golang.org/grpc to 1.83.1 to fix HTTP/2 DATA frame fragmentation memory exhaustion (GO-2026-6348) and updates vulnerable npm dependencies. Version 3.13.3 upgrades klauspost/compress and x/crypto for GO-2026-5841 and GO-2026-6303. No CVE identifiers are provided in the release metadata.

Why it matters

A reviewed impact interpretation has not been published for this record.

Evidence and limitations

Source ID: prometheus_prometheus_releases
Record identifier: 87111e0ecf228da88bc08609bf2f98e8d055ab7aea822a71cc4f856a8f00e2b2
Enrichment time: 2026-10-03T08:51:30Z
AI-assisted enrichment: Yes

This record may overlap with other records. Its enrichment can be incomplete or wrong, and machine assistance was used. Validate consequential decisions against the linked source and your own environment.

← Back to published records