CVE-2026-42154

🗓️ 04 May 2026 18:13:12Reported by GitHub_MType

cve🔗 web.nvd.nist.gov👁 13 Views🌐 WEB

Prometheus remote read endpoint can cause memory exhaustion and crash from a crafted snappy payload.

Reporter	Title	Published	Views	Family All 143
ATTACKERKB	CVE-2026-42154	4 May 202618:13	–	attackerkb
AlpineLinux	CVE-2026-42154	4 May 202618:13	–	alpinelinux
CBLMariner	CVE-2026-42154 affecting package telegraf for versions less than 1.31.0-20	18 May 202620:36	–	cbl_mariner
Chainguard	CVE-2026-42154 vulnerabilities	22 May 202619:18	–	cgr
Circl	CVE-2026-42154	4 May 202619:28	–	circl
CNNVD	Prometheus 资源管理错误漏洞	4 May 202600:00	–	cnnvd
Cvelist	CVE-2026-42154 Prometheus: remote read endpoint allows denial of service via crafted snappy payload	4 May 202618:13	–	cvelist
Debian CVE	CVE-2026-42154	4 May 202618:13	–	debiancve
EUVD	EUVD-2026-27091	5 May 202619:34	–	euvd
Github Security Blog	Prometheus: Remote read endpoint allows denial of service via crafted snappy payload	5 May 202619:34	–	github

NVD

Vulners

Node

prometheus prometheusRange<3.5.3

prometheus prometheusRange3.6.0–3.11.3

[
  {
    "vendor": "prometheus",
    "product": "prometheus",
    "versions": [
      {
        "version": "< 3.5.3",
        "status": "affected"
      },
      {
        "version": ">= 3.6.0, < 3.11.3",
        "status": "affected"
      }
    ]
  }
]

Source	Link
github	www.github.com/prometheus/prometheus/pull/18585
github	www.github.com/prometheus/prometheus/security/advisories/GHSA-8rm2-7qqf-34qm
github	www.github.com/prometheus/prometheus/releases/tag/v3.11.3
github	www.github.com/prometheus/prometheus/releases/tag/v3.5.3
github	www.github.com/prometheus/prometheus/pull/18584

Parameter	Position	Path	Description	CWE
request_body	request body	/api/v1/read	Prometheus remote read endpoint does not validate declared decoded length in snappy-compressed request body, allowing memory exhaustion via large heap allocations.	CWE-789, CWE-400

11 May 2026 17:22Current

5.8Medium risk

Vulners AI Score5.8

CVSS 3.17.5

EPSS0.00022

SSVC