3.5.5 / 2026-07-09
2026-07-09T08:51:47Z•dc0b753f8fe57c0d409e79e892c87887187ab0a159b67c6da3c8b034d7307bc0
OpenTelemetrySTACKITcross-site scriptingdenial-of-servicedependency-upgradegolangprometheusreleaseremote-writesanitize-htmlsecret-exposuresecurity-fixsnappysupply-chainxss
What happened
Multiple Prometheus releases (notably 3.5.5, 3.13.0 LTS, 3.12.0 and 3.5.4) address several security issues in the UI and dependencies and fix server-side issues. Remediations include bumping sanitize-html to mitigate cross-site scripting (CVE-2026-44990 and CVE-2026-53606), fixing a plaintext secret exposure in STACKIT service discovery (GHSA-39j6-789q-qxvh), rejecting oversized snappy-compressed remote-write payloads (DoS mitigation), and upgrading golang.org/x/net and OpenTelemetry to resolve multiple Go advisories (GO-2026-5026, GO-2026-4918, GO-2026-4985). Also includes changes to stop C/I
Why it matters
A reviewed impact interpretation has not been published for this record.
Evidence and limitations
- Source ID
- prometheus_prometheus_releases
- Record identifier
- dc0b753f8fe57c0d409e79e892c87887187ab0a159b67c6da3c8b034d7307bc0
- Enrichment time
- 2026-07-09T08:51:47Z
- AI-assisted enrichment
- Yes
This record may overlap with other records. Its enrichment can be incomplete or wrong, and machine assistance was used. Validate consequential decisions against the linked source and your own environment.