https://cve.radiocsirt.org/rss/recent/all/10 Most recent entries from all 2026-10-03T15:28:13.567828+00:00 Vulnerability-Lookup csirt@opendfir.org python-feedgen Contains only the most 10 recent entries. https://cve.radiocsirt.org/vuln/alsa-2026:34357 ALSA-2026:34357 — Important: opentelemetry-collector security update 2026-10-03T15:28:14.520903+00:00

Affected: AlmaLinux:10: opentelemetry-collector

Collector with the supported components for a AlmaLinux build of OpenTelemetry

Security Fix(es):

* github.com/prometheus/prometheus: Prometheus: Denial of Service via uncontrolled memory allocation in remote read endpoint (CVE-2026-42154) * github.com/prometheus/prometheus: Prometheus: Information disclosure of Azure OAuth client secret via config API (CVE-2026-42151) * net: golang: Go net package: Denial of Service via long CNAME response in LookupCNAME (CVE-2026-33811) * golang.org/x/net/idna: golang: golang.org/x/net/idna: Privilege escalation via incorrect Punycode label processing (CVE-2026-39821) * golang.org/x/net/html: golang.org/x/net/html: Arbitrary code execution via Cross-Site Scripting (CVE-2026-25681) * crypto/x509: golang: golang crypto/x509: Denial of Service via excessive processing of DNS SAN entries (CVE-2026-27145)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

 https://cve.radiocsirt.org/vuln/bit-prometheus-2026-42154 BIT-prometheus-2026-42154 — Prometheus: remote read endpoint allows denial of service via crafted snappy payload 2026-10-03T15:28:14.521005+00:00

Affected: Bitnami: prometheus

Prometheus is an open-source monitoring system and time series database. Prior to versions 3.5.3 and 3.11.3, the remote read endpoint (/api/v1/read) does not validate the declared decoded length in a snappy-compressed request body before allocating memory. An unauthenticated attacker can send a small payload that causes a huge heap allocation per request. Under concurrent load this can exhaust available memory and crash the Prometheus process. This issue has been patched in versions 3.5.3 and 3.11.3.

 https://cve.radiocsirt.org/vuln/certfr-2026-avi-0608 certfr-2026-avi-0608 — De multiples vulnérabilités ont été découvertes dans Microsoft Azure Linux. Elles permettent à un attaquant de provoque… 2026-10-03T15:28:14.521034+00:00 certfr-2026-avi-0608 https://cve.radiocsirt.org/vuln/cleanstart-2026-ap95632 Withdrawn: CLEANSTART-2026-AP95632 — Security fixes for CVE-2026-25679, CVE-2026-27139, CVE-2026-27142, CVE-2026-27143, CVE-2026-27144, CVE-2026-32280, CVE-… 2026-10-03T15:28:14.521053+00:00

Withdrawn by the publisher.

Affected: CleanStart: keda-fips

Multiple security vulnerabilities affect the keda-fips package. These issues are resolved in later releases. See references for individual vulnerability details.

 https://cve.radiocsirt.org/vuln/euvd-2026-366087 EUVD-2026-366087 2026-10-03T15:28:14.521077+00:00 EUVD-2026-366087 https://cve.radiocsirt.org/vuln/fkie_cve-2026-42154 fkie_cve-2026-42154 2026-10-03T15:28:14.521090+00:00

Prometheus is an open-source monitoring system and time series database. Prior to versions 3.5.3 and 3.11.3, the remote read endpoint (/api/v1/read) does not validate the declared decoded length in a snappy-compressed request body before allocating memory. An unauthenticated attacker can send a small payload that causes a huge heap allocation per request. Under concurrent load this can exhaust available memory and crash the Prometheus process. This issue has been patched in versions 3.5.3 and 3.11.3.

 https://cve.radiocsirt.org/vuln/ghsa-8rm2-7qqf-34qm GHSA-8rm2-7qqf-34qm — Prometheus: Remote read endpoint allows denial of service via crafted snappy payload 2026-10-03T15:28:14.521113+00:00

Affected: Go: github.com/prometheus/prometheus

### Impact

The remote read endpoint (`/api/v1/read`) does not validate the declared decoded length in a snappy-compressed request body before allocating memory. An unauthenticated attacker can send a small payload that causes a huge heap allocation per request. Under concurrent load this can exhaust available memory and crash the Prometheus process.

### Patches _Has the problem been patched? What versions should users upgrade to?_

Fixed in 3.11.3 and 3.5.3 LTS. Users should upgrade to these versions or later.

### Workarounds User who can not upgrade can place Prometheus behind a reverse proxy or firewall that requires authentication before requests reach /api/v1/read.

 https://cve.radiocsirt.org/vuln/msrc_cve-2026-42154 msrc_CVE-2026-42154 — Prometheus: remote read endpoint allows denial of service via crafted snappy payload 2026-10-03T15:28:14.521142+00:00 msrc_CVE-2026-42154 https://cve.radiocsirt.org/vuln/opensuse-su-2026:10676-1 openSUSE-SU-2026:10676-1 — golang-github-prometheus-prometheus-3.11.3-1.1 on GA media 2026-10-03T15:28:14.521160+00:00

golang-github-prometheus-prometheus-3.11.3-1.1 on GA media

 https://cve.radiocsirt.org/vuln/rhsa-2026:25039 RHSA-2026:25039 — Red Hat Security Advisory: Red Hat Hardened Images RPMs bug fix and enhancement update 2026-10-03T15:28:14.521178+00:00

github.com/prometheus/prometheus: Prometheus: Information disclosure of Azure OAuth client secret via config API github.com/prometheus/prometheus: Prometheus: Denial of Service via uncontrolled memory allocation in remote read endpoint urllib3: urllib3: Information disclosure via cross-origin redirects forwarding sensitive headers urllib3: urllib3: Denial of Service due to excessive HTTP response decompression python-idna: idna: Denial of Service via specially crafted long inputs joserfc: joserfc: Resource exhaustion via oversized JSON Web Signature (JWS) payloads

 https://cve.radiocsirt.org/vuln/rlsa-2026:34357 RLSA-2026:34357 — Important: opentelemetry-collector security update 2026-10-03T15:28:14.521204+00:00

Affected: Rocky Linux:10: opentelemetry-collector

Collector with the supported components for a Rocky Enterprise Software Foundation build of OpenTelemetry

Security Fix(es):

* github.com/prometheus/prometheus: Prometheus: Denial of Service via uncontrolled memory allocation in remote read endpoint (CVE-2026-42154)

* github.com/prometheus/prometheus: Prometheus: Information disclosure of Azure OAuth client secret via config API (CVE-2026-42151)

* net: golang: Go net package: Denial of Service via long CNAME response in LookupCNAME (CVE-2026-33811)

* golang.org/x/net/idna: golang: golang.org/x/net/idna: Privilege escalation via incorrect Punycode label processing (CVE-2026-39821)

* golang.org/x/net/html: golang.org/x/net/html: Arbitrary code execution via Cross-Site Scripting (CVE-2026-25681)

* crypto/x509: golang: golang crypto/x509: Denial of Service via excessive processing of DNS SAN entries (CVE-2026-27145)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

 https://cve.radiocsirt.org/vuln/suse-su-2026:2774-1 SUSE-SU-2026:2774-1 — Security update 5.1.4 for Multi-Linux Manager Server 2026-10-03T15:28:14.521233+00:00

Security update 5.1.4 for Multi-Linux Manager Server

 https://cve.radiocsirt.org/vuln/ubuntu-cve-2026-42154 UBUNTU-CVE-2026-42154 2026-10-03T15:28:14.521257+00:00

Affected: Ubuntu:16.04:LTS: prometheus, Ubuntu:18.04:LTS: prometheus, Ubuntu:20.04:LTS: prometheus, Ubuntu:Pro:22.04:LTS: prometheus, Ubuntu:Pro:24.04:LTS: prometheus, Ubuntu:25.10: prometheus, Ubuntu:Pro:26.04:LTS: prometheus

Prometheus is an open-source monitoring system and time series database. Prior to versions 3.5.3 and 3.11.3, the remote read endpoint (/api/v1/read) does not validate the declared decoded length in a snappy-compressed request body before allocating memory. An unauthenticated attacker can send a small payload that causes a huge heap allocation per request. Under concurrent load this can exhaust available memory and crash the Prometheus process. This issue has been patched in versions 3.5.3 and 3.11.3.

 https://cve.radiocsirt.org/vuln/wid-sec-w-2026-1292 WID-SEC-W-2026-1292 — Prometheus: Mehrere Schwachstellen 2026-10-03T15:28:14.521287+00:00

Ein Angreifer kann mehrere Schwachstellen in Prometheus ausnutzen, um einen Denial of Service Angriff durchzuführen, vertrauliche Informationen offenzulegen oder Cross-Site-Scripting-Angriffe durchzuführen.