The Quarterly Threat Landscape Report is out. See what attackers are targeting now.Read report
Prometheus is an open-source monitoring system and time series database. Prior to versions 3.5.3 and 3.11.3, the remote read endpoint (/api/v1/read) does not validate the declared decoded length in a snappy-compressed request body before allocating memory. An unauthenticated attacker can send a small payload that causes a huge heap allocation per request. Under concurrent load this can exhaust available memory and crash the Prometheus process. This issue has been patched in versions 3.5.3 and 3.11.3.
| Product | Vendor Advisory | Solution File | Added | Published |
|---|---|---|---|---|
| Alma_linux | — | Upgrade opentelemetry-collector | Jul 7, 2026 | Jul 1, 2026 |
| Alpine Linux | — | Upgrade prometheus | May 5, 2026 | May 4, 2026 |
| Amazon Linux Ami 2 | — | Upgrade amazon-cloudwatch-agent | Jul 8, 2026 | Jul 8, 2026 |
| Redhat_linux | — | Upgrade flightctl-selinuxUpgrade opentelemetry-collectorUpgrade flightctl-cliUpgrade flightctl-observabilityUpgrade flightctl-agentUpgrade flightctl-services | Jul 3, 2026 | May 4, 2026 |
| Rocky_linux | — | Upgrade opentelemetry-collector | Jul 7, 2026 | Jul 5, 2026 |
With curated Threat Intelligence, you can see which vulnerabilities truly put you at risk, prioritize what matters most, and act before attackers do.
Explore Intelligence Hub