Prommetrix

Info: Prommetrix is a free software tool to obtain relevant information from the instances of 'Node Exporter' executed by 'Prometheus'. Prometheus is an open-source, metrics-based event monitoring and alerting solution for cloud applications. It is used by nearly 800 cloud-native organizations...

CLEANSTART-2026-XP69405 HTTP/2 server can refund connection-level flow control twice for the same data: Once when a client resets a stream (refunding data for any sent-but-unread portion of the stream), and again when a r...

Security vulnerability affects the prometheus-node-exporter-fips package. The HTTP/2 server can refund connection-level flow control twice for the same data: Once when a client resets a stream refunding data for any sent-but-unread portion of the stream, and again when a request handler reads the...

CLEANSTART-2026-KH58547 HTTP/2 servers could end up crashing due to inadvertently modifying its HPACK encoder concurrently

Security vulnerability affects the prometheus-node-exporter-fips package. HTTP/2 servers could end up crashing due to inadvertently modifying its HPACK encoder concurrently...

CLEANSTART-2026-SQ02477 malicious HTTP/2 peer can cause excessive CPU consumption in the client or server by opening a large number of streams and then sending many small SETTINGS frames containing SETTINGS_INITIAL_WINDOW...

Security vulnerability affects the prometheus-node-exporter-fips package. A malicious HTTP/2 peer can cause excessive CPU consumption in the client or server by opening a large number of streams and then sending many small SETTINGS frames containing SETTINGSINITIALWINDOWSIZE values...

CLEANSTART-2026-ZJ27938 Historically, we have been rather lax about malformed framing-related headers in our HTTP/2 implementation, as they cannot interfere with HTTP/2 framing

Security vulnerability affects the prometheus-node-exporter-fips package. Historically, we have been rather lax about malformed framing-related headers in our HTTP/2 implementation, as they cannot interfere with HTTP/2 framing...

CLEANSTART-2026-CB70902 When "Trailer" headers are sent by a client, the HTTP server internally uses the header values to populate the Request

Security vulnerability affects the prometheus-node-exporter-fips package. When "Trailer" headers are sent by a client, the HTTP server internally uses the header values to populate the Request...

CVE-2026-78659 affecting package prometheus-node-exporter for versions less than 1.7.0-6

CVE-2026-78659 affecting package prometheus-node-exporter for versions less than 1.7.0-6. A patched version of the package is available...

CVE-2026-78660 affecting package prometheus-node-exporter for versions less than 1.7.0-6

CVE-2026-78660 affecting package prometheus-node-exporter for versions less than 1.7.0-6. A patched version of the package is available...

CVE-2026-78663 affecting package prometheus-node-exporter for versions less than 1.7.0-6

CVE-2026-78663 affecting package prometheus-node-exporter for versions less than 1.7.0-6. A patched version of the package is available...

CVE-2026-78669 affecting package prometheus-node-exporter for versions less than 1.7.0-6

CVE-2026-78669 affecting package prometheus-node-exporter for versions less than 1.7.0-6. A patched version of the package is available...

CVE-2026-97032 affecting package prometheus-node-exporter for versions less than 1.7.0-6

CVE-2026-97032 affecting package prometheus-node-exporter for versions less than 1.7.0-6. A patched version of the package is available...

AZL-107832 CVE-2026-97032 affecting package prometheus-node-exporter for versions less than 1.7.0-6

HTTP/2 servers could end up crashing due to inadvertently modifying its HPACK encoder concurrently. This happens because the server modifies the HPACK encoder from two goroutines without synchronization: one uses the encoder to encode a HEADERS frame as part of a response sent to a client and the...

AZL-107826 CVE-2026-78669 affecting package prometheus-node-exporter for versions less than 1.7.0-6

A malicious HTTP/2 peer can cause excessive CPU consumption in the client or server by opening a large number of streams and then sending many small SETTINGS frames containing SETTINGSINITIALWINDOWSIZE values...

AZL-107835 CVE-2026-78659 affecting package prometheus-node-exporter for versions less than 1.7.0-6

When "Trailer" headers are sent by a client, the HTTP server internally uses the header values to populate the Request.Trailer map passed to the server handler. Because Request.Trailer is a map, each entry incurs memory overhead. For HTTP/2 servers, a malicious client can exploit this by sending ...

AZL-107823 CVE-2026-78660 affecting package prometheus-node-exporter for versions less than 1.7.0-6

Historically, we have been rather lax about malformed framing-related headers in our HTTP/2 implementation, as they cannot interfere with HTTP/2 framing. However, this makes it possible for our HTTP/2 implementation to forward responses containing such headers to an HTTP/1 client when acting as a...

AZL-107829 CVE-2026-78663 affecting package prometheus-node-exporter for versions less than 1.7.0-6

The HTTP/2 server can refund connection-level flow control twice for the same data: Once when a client resets a stream refunding data for any sent-but-unread portion of the stream, and again when a request handler reads the buffered data. A malicious client can exploit this to bypass the configur...

CLEANSTART-2026-PO69653 Security fix for CVE-2022-46146 applied in: prometheus 2.40.4-r1, prometheus-fips 2.40.4-r1, prometheus-node-exporter 1.5.0-r0, prometheus-node-exporter-fips 1.5.0-r0

CVE-2022-46146 affects multiple packages. This issue is resolved in later releases. See references for individual vulnerability details...

CLEANSTART-2026-RD73080 Security fix for GHSA-cgrx-mc8f-2prm applied in: eks-distro-kube-apiserver 1.34.2-r0, eks-distro-kube-apiserver-fips 1.34.2-r0, eks-distro-kube-controller-manager-fips 1.34.2-r0, kaniko 1.24.0-r0, kaniko-fips 1.24.0-r0, local-static-provisioner 2.6.0-r1, local-static-provisioner-fips 2.6.0-r1, local-static-provisioner-fips 2.7.0-r1, prometheus-node-exporter 1.8.0-r3, prometheus-node-exporter-fips 1.10.2-r1, prometheus-node-exporter-fips 1.10.2-r3, prometheus-node-exporter-fips 1.7.0-r2, prometheus-node-exporter-fips 1.8.2-r2, prometheus-node-exporter-fips 1.9.1-r1, runc 1.1.14-r0, skaffold 2.16.1-r1, trivy-fips 0.67.2-r0, velero 1.17.0-r0

GHSA-cgrx-mc8f-2prm affects multiple packages. This issue is resolved in later releases. See references for individual vulnerability details...

CLEANSTART-2026-ZC33521 Security fix for CVE-2025-22873 applied in: cosign 2.4.3-r0, cosign 2.5.3-r0, flux-notification-controller-fips 1.5.0-r0, kubernetes-csi-node-driver-registrar 2.13.0-r0, nvidia-container-toolkit 1.19.0-r0, prometheus-node-exporter 1.8.0-r3, runc 1.1.14-r0

CVE-2025-22873 affects multiple packages. This issue is resolved in later releases. See references for individual vulnerability details...

CLEANSTART-2026-YU49777 Security fix for CVE-2026-28735 applied in: prometheus-node-exporter 1.10.2-r3, prometheus-node-exporter 1.11.1-r2, prometheus-node-exporter 1.12.1-r0, prometheus-node-exporter 1.9.1-r3

CVE-2026-28735 affects multiple packages. This issue is resolved in later releases. See references for individual vulnerability details...