CVE-2026-40179-PoC

CVE-2026-40179 — 通过 remotewrite 实现的 Prometheus 存储型 XSS 针对 CVE-2026-40179 （GHSA-vffh-x6r8-xx99）的一个最小化、低依赖的概念验证：通过未认证的 remotewrite 接口，在 Prometheus Web UI 中实现存储型跨站脚本攻击。 漏洞详情 Prometheus 3.x 在将指标名称和标签值渲染到 Web UI 时使用了 innerHTML 且未进行转义。由于 Prometheus v3 放宽了标签验证规则以允许任意 UTF-8 字符 — 包括 和 " — 指标名称可以携带 HTML...

Elastic Beats metricbeat 8.0.x < 8.19.13 / 9.0.x < 9.2.5 DoS (ESA-2026-09)

The version of Elastic Beats metricbeat installed on the remote host is 8.0.x prior to 8.19.13, 9.0.x prior to 9.2.5. It is, therefore, affected by a denial of service vulnerability. - Memory Allocation with Excessive Size Value CWE-789 in the Prometheus remotewrite HTTP handler in Metricbeat can...

CVE-2026-26931

Memory Allocation with Excessive Size Value CWE-789 in the Prometheus remotewrite HTTP handler in Metricbeat can lead Denial of Service via Excessive Allocation CAPEC-130...

CVE-2026-26931 Memory Allocation with Excessive Size Value in Metricbeat Leading to Denial of Service

Memory Allocation with Excessive Size Value CWE-789 in the Prometheus remotewrite HTTP handler in Metricbeat can lead Denial of Service via Excessive Allocation CAPEC-130...

Metricbeat 8.19.13, 9.2.5 Security Update (ESA-2026-09)

Memory Allocation with Excessive Size Value in Metricbeat Leading to Denial of Service Memory Allocation with Excessive Size Value CWE-789 in the Prometheus remotewrite HTTP handler in Metricbeat can lead Denial of Service via Excessive Allocation CAPEC-130. Affected Versions: 8.x: All versions...