CVE-2026-42154

prometheus

TLP:CLEAR

csirt@kutim:~/threat-intel/cve/CVE-2026-42154

Katalog CVE

CVSS 7.5 · High EPSS 0,89%

Kerentanan Uncontrolled Resource Consumption pada prometheus. Skor CVSS 3.1 7.5 (High) menurut github.com.

Deskripsi (NVD)

Prometheus is an open-source monitoring system and time series database. Prior to versions 3.5.3 and 3.11.3, the remote read endpoint (/api/v1/read) does not validate the declared decoded length in a snappy-compressed request body before allocating memory. An unauthenticated attacker can send a small payload that causes a huge heap allocation per request. Under concurrent load this can exhaust available memory and crash the Prometheus process. This issue has been patched in versions 3.5.3 and 3.11.3.

Rincian

Terbit di NVD
4 Mei 2026
Terakhir diubah
10 September 2026
Status NVD
Modified
CVSS 3.1
7.5 (High), sumber github.com
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H · uraikan di kalkulator
Jenis kelemahan (CWE)
CWE-400: Uncontrolled Resource Consumption
CWE-789: Memory Allocation with Excessive Size Value
CWE-770: Allocation of Resources Without Limits or Throttling
EPSS (30 hari)
0,89% peluang dieksploitasi; lebih tinggi dari 58,3% CVE lain

Produk dan versi terdampak

VendorProdukVersi terdampak
prometheus prometheus Semua versi sebelum 3.5.3
prometheus prometheus Versi 3.6.0 hingga sebelum 3.11.3

> Data dari konfigurasi CPE di NVD.

Referensi dan perbaikan

Sumber: NVD · CVE.org · EPSS. Halaman ini disusun otomatis dari data tersebut; pembaruan terakhir 5 Okt 2026, 20:11 WITA. Kalau sistem di Perangkat Daerah memakai produk ini dan butuh bantuan, laporkan lewat kanal pelaporan.