[SECURITY] Fedora 44 Update: prometheus-3.12.0-1.fc44

The Prometheus monitoring system and time series database...

[SECURITY] Fedora 43 Update: prometheus-3.12.0-1.fc43

The Prometheus monitoring system and time series database...

dms (0.0.1), fastapi (>=0.38.0, <=0.40.0) +6 more potentially affected by CVE-2026-54282 via starlette (0.12.8)

starlette PYPI version 0.12.8 is affected by a known vulnerability. The following packages have a transitive dependency on starlette and may be impacted: - dms 0.0.1 - fastapi =0.38.0, =0.1.24, =5.4.0, =0.1.0, =0.0.1, =0.14.4, =0.15.0 Source cves: CVE-2026-54282 Source advisory: OSV:PYSEC-2026-24...

Important: Red Hat Security Advisory: Cost Management Metrics Operator Update

Cost Management Metrics Operator version 4.4.1 release. The Cost Management Metrics Operator is a component of the Red Hat Cost Managment service for Openshift. The operator runs on the latest supported versions of Openshift. This operator obtains OpenShift usage data by querying Prometheus every...

Fedora 44 : prometheus (2026-ebaf2bfd71)

The remote Fedora 44 host has a package installed that is affected by multiple vulnerabilities as referenced in the FEDORA-2026-ebaf2bfd71 advisory. Update to 3.12.0 Tenable has extracted the preceding description block directly from the Fedora security advisory. Note that Nessus has not tested f...

Fedora 43 : prometheus (2026-dfc0e362e6)

The remote Fedora 43 host has a package installed that is affected by multiple vulnerabilities as referenced in the FEDORA-2026-dfc0e362e6 advisory. Update to 3.12.0 Tenable has extracted the preceding description block directly from the Fedora security advisory. Note that Nessus has not tested f...

ROOT-APP-GOBINARY-CVE-2026-40179 CVE-2026-40179 in rootio-github.com/prometheus/prometheus - Patched by Root

Root has patched CVE-2026-40179 in the rootio-github.com/prometheus/prometheus package for Root:Go. Multiple fixed versions available...

ROOT-APP-GOBINARY-CVE-2026-44903 CVE-2026-44903 in rootio-github.com/prometheus/prometheus - Patched by Root

Root has patched CVE-2026-44903 in the rootio-github.com/prometheus/prometheus package for Root:Go. Multiple fixed versions available...

ROOT-APP-GOBINARY-GHSA-FW8G-CG8F-9J28 GHSA-fw8g-cg8f-9j28 in rootio-github.com/prometheus/prometheus - Patched by Root

Root has patched GHSA-fw8g-cg8f-9j28 in the rootio-github.com/prometheus/prometheus package for Root:Go. Multiple fixed versions available...

OPENSUSE-SU-2026:21136-1 Security update for golang-github-prometheus-alertmanager

This update for golang-github-prometheus-alertmanager fixes the following issues: Changes in golang-github-prometheus-alertmanager: - Update to version 0.28.1 jscPED-13285: Improved performance of inhibition rules when using Equal labels. Improve the documentation on escaping in UTF-8 matchers...

PT-2026-53155

Root has patched GHSA-fw8g-cg8f-9j28 in the rootio-github.com/prometheus/prometheus package for Root:Go. Multiple fixed versions available...

dms (0.0.1), fastapi (>=0.38.0, <=0.40.0) +6 more potentially affected by CVE-2026-48817 via starlette (0.12.8)

starlette PYPI version 0.12.8 is affected by a known vulnerability. The following packages have a transitive dependency on starlette and may be impacted: - dms 0.0.1 - fastapi =0.38.0, =0.1.24, =5.4.0, =0.1.0, =0.0.1, =0.14.4, =0.15.0 Source cves: CVE-2026-48817 Source advisory: OSV:PYSEC-2026-22...

dms (0.0.1), fastapi (>=0.38.0, <=0.40.0) +6 more potentially affected by CVE-2026-48818 via starlette (0.12.8)

starlette PYPI version 0.12.8 is affected by a known vulnerability. The following packages have a transitive dependency on starlette and may be impacted: - dms 0.0.1 - fastapi =0.38.0, =0.1.24, =5.4.0, =0.1.0, =0.0.1, =0.14.4, =0.15.0 Source cves: CVE-2026-48818 Source advisory:...

dms (0.0.1), fastapi (>=0.38.0, <=0.40.0) +6 more potentially affected by CVE-2026-48817 via starlette (0.12.8)

starlette PYPI version 0.12.8 is affected by a known vulnerability. The following packages have a transitive dependency on starlette and may be impacted: - dms 0.0.1 - fastapi =0.38.0, =0.1.24, =5.4.0, =0.1.0, =0.0.1, =0.14.4, =0.15.0 Source cves: CVE-2026-48817 Source advisory:...

github.com/prometheus/prometheus: Prometheus: Information disclosure of Azure OAuth client secret via config API

A flaw was found in Prometheus, an open-source monitoring system. The clientsecret field within the Azure Active Directory AD remote write OAuth configuration was incorrectly handled as a plain string instead of a secure Secret type. This misconfiguration allowed any user or process with access t...

golang-github-prometheus-prometheus-3.12.0-2.1 on GA media (moderate)

golang-github-prometheus-prometheus-3.12.0-2.1 on GA media Announcement ID: openSUSE-SU-2026:10997-1 Rating: moderate Cross-References: CVE-2026-39821 CVSS scores: CVE-2026-39821 SUSE : 7.4 CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N CVE-2026-39821 SUSE : 9.1...

OPENSUSE-SU-2026:11012-1 golang-github-prometheus-node_exporter-1.11.1-2.1 on GA media

These are all security issues fixed in the golang-github-prometheus-nodeexporter-1.11.1-2.1 package on the GA media of openSUSE Tumbleweed...

OPENSUSE-SU-2026:11011-1 golang-github-prometheus-alertmanager-0.32.2-2.1 on GA media

These are all security issues fixed in the golang-github-prometheus-alertmanager-0.32.2-2.1 package on the GA media of openSUSE Tumbleweed...

github.com/prometheus/prometheus: Prometheus: Denial of Service via uncontrolled memory allocation in remote read endpoint

A flaw was found in Prometheus. An unauthenticated attacker can exploit the remote read endpoint /api/v1/read by sending a specially crafted, small snappy-compressed payload. This payload causes a disproportionately large memory allocation, leading to memory exhaustion and a Denial of Service DoS...

github.com/prometheus/prometheus: Prometheus: Information disclosure of Azure OAuth client secret via config API

A flaw was found in Prometheus, an open-source monitoring system. The clientsecret field within the Azure Active Directory AD remote write OAuth configuration was incorrectly handled as a plain string instead of a secure Secret type. This misconfiguration allowed any user or process with access t...