v3.15.0-rc.1

2026-09-22T08:51:31Z•fd55dcfb94ad7b06859112232c2905505720c95e72452e2aa554102a6484cbd6

CVE-2026-56852Denial-of-ServiceGO-2026-5841GO-2026-6303Prometheusdependency-updategithub.com/klauspost/compressgolang.org/x/cryptogolang.org/x/textgoogle.golang.org/grpcsecurity-update

Open source link →

What happened

Prometheus releases include security dependency updates in versions 3.13.2 and 3.13.3. Prometheus 3.13.2 updates golang.org/x/text for CVE-2026-56852 and google.golang.org/grpc for GHSA-hrxh-6v49-42gf; 3.13.3 updates klauspost/compress for GO-2026-5841 and golang.org/x/crypto for GO-2026-6303. The releases also contain stability and query-processing fixes. Organizations should upgrade to a release containing these dependency updates.

Why it matters

A reviewed impact interpretation has not been published for this record.

Evidence and limitations

Source ID: prometheus_prometheus_releases
Record identifier: fd55dcfb94ad7b06859112232c2905505720c95e72452e2aa554102a6484cbd6
Enrichment time: 2026-09-22T08:51:31Z
AI-assisted enrichment: Yes

This record may overlap with other records. Its enrichment can be incomplete or wrong, and machine assistance was used. Validate consequential decisions against the linked source and your own environment.

← Back to published records