CLEANSTART-2026-TL04302 Security fixes for CVE-2025-61727, CVE-2025-61729, ghsa-cgrx-mc8f-2prm, ghsa-f6x5-jh6r-wrfv, ghsa-j5w8-q4qc-rx2x, ghsa-vvgc-356p-c3xw applied in versions: 1.10.2-r0, 1.10.2-r1, 1.5.0-r0, 1.9.1-r0

Multiple security vulnerabilities affect the prometheus-node-exporter-fips package. These issues are resolved in later releases. See references for individual vulnerability details...

CLEANSTART-2026-HO21235 Security fixes for CVE-2025-61726, CVE-2025-61728, CVE-2025-61730, CVE-2025-61732, CVE-2025-68119, CVE-2025-68121, CVE-2026-25679, CVE-2026-27139, CVE-2026-27142 applied in versions: 0.87.1-r0, 0.89.0-r0

Multiple security vulnerabilities affect the prometheus-operator package. These issues are resolved in later releases. See references for individual vulnerability details...

CLEANSTART-2026-LN66182 Security fixes for CVE-2025-61726, CVE-2025-61727, CVE-2025-61728, CVE-2025-61729, CVE-2025-61730, CVE-2025-61732, CVE-2025-68119, CVE-2025-68121, CVE-2026-25679, CVE-2026-27139, CVE-2026-27142, CVE-2026-32280, CVE-2026-32281, CVE-2026-32282, CVE-2026-32283, CVE-2026-32289, CVE-2026-33810, CVE-2026-33811, CVE-2026-33814, CVE-2026-34743, CVE-2026-39820, CVE-2026-39823, CVE-2026-39825, CVE-2026-39826, CVE-2026-39836, CVE-2026-42499 applied in versions: 1.79.0-r0, 1.79.0-r2, 1.79.0-r3, 1.79.0-r4, 1.79.0-r5

Multiple security vulnerabilities affect the prometheus-redis-exporter-fips package. These issues are resolved in later releases. See references for individual vulnerability details...

CLEANSTART-2026-CD91667 Security fixes for CVE-2025-61726, CVE-2025-61727, CVE-2025-61728, CVE-2025-61729, CVE-2025-61730, CVE-2025-61732, CVE-2025-68119, CVE-2025-68121, CVE-2026-25679, CVE-2026-27139, CVE-2026-27142, CVE-2026-32280, CVE-2026-32281, CVE-2026-32282, CVE-2026-32283, CVE-2026-32289, CVE-2026-33810, CVE-2026-33811, CVE-2026-33814, CVE-2026-34743, CVE-2026-39820, CVE-2026-39823, CVE-2026-39825, CVE-2026-39826, CVE-2026-39836, CVE-2026-42499 applied in versions: 1.78.0-r0, 1.78.0-r2, 1.78.0-r3, 1.78.0-r4, 1.78.0-r5

Multiple security vulnerabilities affect the prometheus-redis-exporter-fips package. These issues are resolved in later releases. See references for individual vulnerability details...

CLEANSTART-2026-MR50866 Security fixes for CVE-2026-25679, CVE-2026-27139, CVE-2026-27142, CVE-2026-27143, CVE-2026-27144, CVE-2026-32280, CVE-2026-32281, CVE-2026-32282, CVE-2026-32283, CVE-2026-32289, CVE-2026-33810, CVE-2026-33811, CVE-2026-33814, CVE-2026-34743, CVE-2026-39820, CVE-2026-39823, CVE-2026-39825, CVE-2026-39826, CVE-2026-39836, CVE-2026-42499 applied in versions: 1.81.0-r0, 1.81.0-r1, 1.81.0-r2

Multiple security vulnerabilities affect the prometheus-redis-exporter-fips package. These issues are resolved in later releases. See references for individual vulnerability details...

CLEANSTART-2026-UF28691 Security fixes for CVE-2026-27143, CVE-2026-27144, CVE-2026-32280, CVE-2026-32281, CVE-2026-32282, CVE-2026-32283, CVE-2026-32289, CVE-2026-33810, CVE-2026-33811, CVE-2026-33814, CVE-2026-34743, CVE-2026-39820, CVE-2026-39823, CVE-2026-39825, CVE-2026-39826, CVE-2026-39836, CVE-2026-42499 applied in versions: 1.82.0-r0, 1.82.0-r1, 1.82.0-r2

Multiple security vulnerabilities affect the prometheus-redis-exporter-fips package. These issues are resolved in later releases. See references for individual vulnerability details...

CLEANSTART-2026-OS08278 Security fixes for CVE-2025-61727, CVE-2025-61729, ghsa-cgrx-mc8f-2prm, ghsa-f6x5-jh6r-wrfv, ghsa-j5w8-q4qc-rx2x, ghsa-vvgc-356p-c3xw applied in versions: 1.10.2-r0, 1.10.2-r1, 1.5.0-r0, 1.9.1-r0

Multiple security vulnerabilities affect the prometheus-node-exporter-fips package. These issues are resolved in later releases. See references for individual vulnerability details...

PT-2026-41785

Name of the Vulnerable Software and Affected Versions OpenTelemetry eBPF Instrumentation versions prior to 0.9.0 Description OpenTelemetry eBPF Instrumentation OBI replays BPF probe hits into histogram observations by looping once per recorded run count. On busy systems, the run-count delta can...

Denial-of-service (DoS)

github.com/prometheus/prometheus is vulnerable to Denial-of-service DoS. The vulnerability is due to improper validation of the declared decoded length in snappy-compressed requests sent to the remote read endpoint /api/v1/read, which allows an unauthenticated attacker to send a small malicious...

CVE-2026-44903 vulnerabilities

Vulnerabilities for packages: jaeger, keda, datadog-agent, tempo, loki, fluent-bit-plugin-loki, opentelemetry-collector-contrib, minio, trillian, node-problem-detector, k8sgpt, minio-object-browser, istio, opentelemetry-operator, mc, prometheus-pushgateway, amazon-cloudwatch-agent-operator,...

0perator (>=0.1.0, <=0.3.0), @0byte/oc_mlflow_plugin (>=0.1.1, <=0.1.3) +2292 more potentially affected by CVE-2026-44902 via @opentelemetry/exporter-prometheus (>=0.9.0, <=0.216.0)

@opentelemetry/exporter-prometheus NPM version =0.9.0, =0.1.0, =0.1.1, =0.1.0, =0.0.1, =1.0.21, =0.0.1, =0.8.0, =0.1.1, =0.1.1, =0.1.1, =0.1.8, =0.1.5, =0.0.0-dev-nicolas-fix-publishing-aurora-mcp-1750279939, =0.0.65, =0.2.0, =0.2.13 and more Source cves: CVE-2026-44902 Source advisory:...

Prometheus exporter process crash via malformed HTTP request

Summary A single malformed HTTP request crashes any Node.js process running the OpenTelemetry JS Prometheus exporter. The metrics endpoint default 0.0.0.0:9464 has no error handling around URL parsing, so a request with an invalid URI causes an uncaught TypeError that terminates the process. You...

0perator (>=0.1.0, <=0.3.0), @0byte/oc_mlflow_plugin (>=0.1.1, <=0.1.3) +2292 more potentially affected by CVE-2026-44902 via @opentelemetry/exporter-prometheus (>=0.9.0, <=0.216.0)

@opentelemetry/exporter-prometheus NPM version =0.9.0, =0.1.0, =0.1.1, =0.1.0, =0.0.1, =1.0.21, =0.0.1, =0.8.0, =0.1.1, =0.1.1, =0.1.1, =0.1.8, =0.1.5, =0.0.0-dev-nicolas-fix-publishing-aurora-mcp-1750279939, =0.0.65, =0.2.0, =0.2.13 and more Source cves: CVE-2026-44902 Source advisory:...

GHSA-Q7RR-3CGH-J5R3 Prometheus exporter process crash via malformed HTTP request

Summary A single malformed HTTP request crashes any Node.js process running the OpenTelemetry JS Prometheus exporter. The metrics endpoint default 0.0.0.0:9464 has no error handling around URL parsing, so a request with an invalid URI causes an uncaught TypeError that terminates the process. You...

Improper Handling of Exceptional Conditions

Overview @opentelemetry/exporter-prometheus is an OpenTelemetry Exporter Prometheus provides a metrics endpoint for Prometheus Affected versions of this package are vulnerable to Improper Handling of Exceptional Conditions via the PrometheusExporter process. An attacker can cause the process to...

PT-2026-39676

Name of the Vulnerable Software and Affected Versions opentelemetry-js versions prior to 0.217.0 Description A single malformed HTTP request can crash any Node.js process running the OpenTelemetry JS Prometheus exporter. The metrics endpoint default '0.0.0.0:9464' lacks error handling during URL...

GHSA-3V2C-X6Q9-F697 vulnerabilities

Vulnerabilities for packages: terraform-provider-grafana-fips, metrics-server-fips, conftest-fips, k8s-agents-operator-fips, crossplane-provider-aws-athena-fips, crossplane-provider-aws-sesv2-fips, chainloop-control-plane-fips, crossplane-provider-aws-s3-fips, crossplane-provider-aws-sesv2,...

CVE-2026-39823 vulnerabilities

Vulnerabilities for packages: terraform-provider-grafana-fips, metrics-server-fips, conftest-fips, k8s-agents-operator-fips, crossplane-provider-aws-athena-fips, crossplane-provider-aws-sesv2-fips, chainloop-control-plane-fips, crossplane-provider-aws-s3-fips, crossplane-provider-aws-sesv2,...

GHSA-2283-WF8C-RW8R vulnerabilities

Vulnerabilities for packages: terraform-provider-grafana-fips, metrics-server-fips, conftest-fips, k8s-agents-operator-fips, crossplane-provider-aws-athena-fips, crossplane-provider-aws-sesv2-fips, chainloop-control-plane-fips, crossplane-provider-aws-s3-fips, crossplane-provider-aws-sesv2,...

CVE-2026-39826 vulnerabilities

Vulnerabilities for packages: terraform-provider-grafana-fips, metrics-server-fips, conftest-fips, k8s-agents-operator-fips, crossplane-provider-aws-athena-fips, crossplane-provider-aws-sesv2-fips, chainloop-control-plane-fips, crossplane-provider-aws-s3-fips, crossplane-provider-aws-sesv2,...