Skip to main content
cve.nowby Sazabi
← Go
GoPackage

github.com/prometheus/prometheus

4 known vulnerabilities (2 high, 2 medium), with the versions each affects and the releases that fix them.

Latest release
Not known: cve.now hasn't read this package's releases
Newest unaffected release
Not known without release data
Advisories
4 · 2 high, 2 medium
Registry
pkg.go.dev

Advisories 4

  • CVE-2026-44903Medium 5.1

    Prometheus: Stored XSS via crafted histogram bucket label values in the heatmap display of the old Prometheus web UI

    Affected: fixed in 0.311.3.

  • Prometheus: remote read endpoint allows denial of service via crafted snappy payload

    Affected: from 0.306.0, fixed in 0.311.3; fixed in 0.305.2; from 1.0.0-rc.0, through 2.5.0; fixed in 0.305.2; from 0.306.0, fixed in 0.311.3; from 1.0.0-rc.0.

  • Prometheus Azure AD remote write OAuth client secret exposed via config API

    Affected: from 0.45.2, fixed in 0.311.3.

  • CVE-2026-40179Medium 5.3

    Prometheus: Stored XSS via metric names and label values in web UI tooltips and metrics explorer

    Affected: fixed in 0.311.2-0.20260410083055-07c6232d159b; from 3.0.0, fixed in 3.5.2; from 3.6.0, fixed in 3.11.2.