v3.16.0-rc.1
2026-10-28T08:51:31Z•d44aeefed2c2b58c7e0027cdb418f156ab303e30086c55a538e29d8db5d86a3a
CA-certificatesGoHTTP/2OpenTelemetryPrometheuscertificate-authority-compromisecrypto/tlsgRPCgolang.org/x/nethtml/templateinformation-disclosurememory-exhaustionnet/httpnet/textprotonpm-dependenciessecurity-update
What happened
Prometheus releases 3.15.1 and 3.13.5 address multiple security issues, including Go standard-library vulnerabilities, HTTP/2 vulnerabilities in golang.org/x/net, compromised certificate authorities, and an OpenTelemetry exporter endpoint information leak. Version 3.13.5 also updates OpenTelemetry, while 3.13.4 fixes an HTTP/2 memory-exhaustion issue through a gRPC update and vulnerable UI dependencies.
Why it matters
A reviewed impact interpretation has not been published for this record.
Evidence and limitations
- Source ID
- prometheus_prometheus_releases
- Record identifier
- d44aeefed2c2b58c7e0027cdb418f156ab303e30086c55a538e29d8db5d86a3a
- Enrichment time
- 2026-10-28T08:51:31Z
- AI-assisted enrichment
- Yes
This record may overlap with other records. Its enrichment can be incomplete or wrong, and machine assistance was used. Validate consequential decisions against the linked source and your own environment.