{"schemaVersion":3,"id":"SUSE-SU-2026:4606-1","aliases":[],"status":"published","duplicateOf":null,"title":null,"description":"Security update for golang-github-prometheus-prometheus\n\nThis update for golang-github-prometheus-prometheus fixes the following issues:\n\ngolang-github-prometheus-prometheus was updated to version 3.13.2:\n\n- Security issues:\n\n  * CVE-2026-39821: Fixed validation bypass and privilege escalation in Punycode label handling (bsc#1266608)\n  * CVE-2026-56852: Fixed infinite loop on truncated or invalid UTF-8 input in unicode/norm handling (bsc#1272102)\n  * CVE-2026-44990: Fixed stored XSS in the new React UI by sanitizing disallowed xmp elements (bsc#1275205)\n  * CVE-2026-53606: Fixed incomplete URI scheme validation in sanitize-html that could enable XSS (bsc#1269966)\n  * CVE-2026-2303: Fixed heap out-of-bounds read in GSSAPI error handling in mongo-driver (bsc#1269856)\n  * CVE-2025-4673: Fixed credential leaks by stopping HTTP client header forwarding on redirects (bsc#1275206)\n  * CVE-2023-45289: Fixed credential leaks by stopping header and cookie forwarding on HTTP redirects (bsc#1275207)\n  * CVE-2025-61686: Fixed unauthorized file access and path traversal in react-router storage (bsc#1270711)\n  * CVE-2026-40181: Fixed open redirect risks to external domains via relative paths in react-router (bsc#1267528)\n  * CVE-2026-42342: Fixed DoS risks via unbounded path expansion in the manifest endpoint (bsc#1267538)\n  * CVE-2026-42211: Fixed remote code execution risks from prototype pollution in react-router (bsc#1267534)\n  * CVE-2026-39882: Fixed memory exhaustion via uncapped HTTP response reading in OpenTelemetry (bsc#1274221)\n  * Fixed potential denial-of-service vulnerabilities by updating the gRPC dependency\n  * Fixed memory exhaustion and DoS by rejecting snappy-compressed requests exceeding 32MB limit\n\n- Bug fixes and changes:\n\n  * Fixed scrape manager failing to reload properly when SD configuration changes rapidly.\n  * Prevent memory leak in remote-write path when the receiving endpoint is unavailable.\n  * Native Histograms are no longer experimental. They are fully supported for production workloads.\n  * Added support for OpenTelemetry traces within the Prometheus UI to correlate metrics and traces.\n  * TSDB compaction speed optimized by improving the block merging algorithm.\n  * Allow scraping of multiple targets using a single HTTP/2 connection to reduce overhead.\n  * Added new metrics to monitor the health of the rule evaluation engine.\n  * Incompatible: This affects scraping, remote read and write, alerting, and SD. Network paths might need adjustments\n    to avoid redirects.\n  * Incompatible: Rule group pagination tokens now use SHA-256 instead of MD5. Custom API consumers must adapt to the\n    new longer token format.\n  * Added 'group_limit' parameter to PromQL aggregations to restrict the number of results.\n  * Incompatible: promtool relative paths in config files now resolve relative to the config directory itself, instead\n    of the current working directory.\n  * Support exporting TSDB blocks directly to cloud storage via the admin API.\n  * Incompatible: Deprecated remote-write metrics like prometheus_remote_storage_samples_total are removed in favor of\n    prometheus_wal_watcher_records_read_total.\n  * Significant query performance boost for high-cardinality regex matchers.\n  * Introduce a new UI interface for safely deleting specific time series data directly.\n  * Added dynamic relabeling actions to extract substrings using regex capture groups.\n  * Fixed UI displaying incorrect time ranges after a timezone change.\n  * Bumped firewalld-prometheus-config to version 0.2 bumping OpenTelemetry to 1.43.0","dates":{"published":"2026-10-09T12:30:05.000Z","modified":"2026-10-10T09:30:06.444Z","reserved":null,"kevAdded":[],"kevDue":[]},"cvss":{"headline":{"score":null,"severity":"unknown","version":null,"versionLabel":null,"source":null,"vector":null,"computed":false,"selection":"none"},"metrics":[]},"epss":{"probability":null,"percentile":null,"severity":"unknown","asOf":null,"change":{"pp":null,"baselineDate":null,"baselineScore":null},"history":[],"last30":[]},"kev":{"state":"not-listed","entries":[],"listedCount":0,"totalCatalogs":3,"catalogs":[{"source":"cisa","label":"CISA","listed":false,"entry":null},{"source":"enisa","label":"ENISA","listed":false,"entry":null},{"source":"circl","label":"CIRCL","listed":false,"entry":null}]},"ransomware":{"state":"none-recorded","sources":[]},"exploits":[],"exploitCount":0,"weaknesses":[],"affected":[{"vendor":"suse","product":"golang-github-prometheus-prometheus&distro=SUSE Linux Enterprise Module for Package Hub 15 SP7","name":"golang-github-prometheus-prometheus","label":"golang-github-prometheus-prometheus&distro=SUSE Linux Enterprise Module for Package Hub 15 SP7","ecosystem":"SUSE Linux Enterprise","cpePart":null,"purl":"pkg:rpm/suse/golang-github-prometheus-prometheus&distro=SUSE Linux Enterprise Module for Package Hub 15 SP7","purlType":"rpm","versions":[{"text":"< 3.13.2-150100.4.40.2","noFixRecorded":false,"fixedIn":null}],"versionsText":"< 3.13.2-150100.4.40.2","eol":null,"hubHref":null}],"affectedCount":1,"eol":{"hasEol":false,"count":0},"references":[{"url":"https://www.suse.com/support/update/announcement/2026/suse-su-20264606-1/","label":"www.suse.com/support/update/announcement/2026/suse-su-20264606-1/","hostname":"www.suse.com","tags":["Advisory"]},{"url":"https://bugzilla.suse.com/1266608","label":"bugzilla.suse.com/1266608","hostname":"bugzilla.suse.com","tags":["REPORT"]},{"url":"https://bugzilla.suse.com/1267528","label":"bugzilla.suse.com/1267528","hostname":"bugzilla.suse.com","tags":["REPORT"]},{"url":"https://bugzilla.suse.com/1267534","label":"bugzilla.suse.com/1267534","hostname":"bugzilla.suse.com","tags":["REPORT"]},{"url":"https://bugzilla.suse.com/1267538","label":"bugzilla.suse.com/1267538","hostname":"bugzilla.suse.com","tags":["REPORT"]},{"url":"https://bugzilla.suse.com/1269856","label":"bugzilla.suse.com/1269856","hostname":"bugzilla.suse.com","tags":["REPORT"]},{"url":"https://bugzilla.suse.com/1269966","label":"bugzilla.suse.com/1269966","hostname":"bugzilla.suse.com","tags":["REPORT"]},{"url":"https://bugzilla.suse.com/1270711","label":"bugzilla.suse.com/1270711","hostname":"bugzilla.suse.com","tags":["REPORT"]},{"url":"https://bugzilla.suse.com/1272102","label":"bugzilla.suse.com/1272102","hostname":"bugzilla.suse.com","tags":["REPORT"]},{"url":"https://bugzilla.suse.com/1274221","label":"bugzilla.suse.com/1274221","hostname":"bugzilla.suse.com","tags":["REPORT"]},{"url":"https://bugzilla.suse.com/1275205","label":"bugzilla.suse.com/1275205","hostname":"bugzilla.suse.com","tags":["REPORT"]},{"url":"https://bugzilla.suse.com/1275206","label":"bugzilla.suse.com/1275206","hostname":"bugzilla.suse.com","tags":["REPORT"]},{"url":"https://bugzilla.suse.com/1275207","label":"bugzilla.suse.com/1275207","hostname":"bugzilla.suse.com","tags":["REPORT"]},{"url":"https://www.suse.com/security/cve/CVE-2023-45289","label":"www.suse.com/security/cve/CVE-2023-45289","hostname":"www.suse.com","tags":["WEB"]},{"url":"https://www.suse.com/security/cve/CVE-2025-4673","label":"www.suse.com/security/cve/CVE-2025-4673","hostname":"www.suse.com","tags":["WEB"]},{"url":"https://www.suse.com/security/cve/CVE-2025-61686","label":"www.suse.com/security/cve/CVE-2025-61686","hostname":"www.suse.com","tags":["WEB"]},{"url":"https://www.suse.com/security/cve/CVE-2026-2303","label":"www.suse.com/security/cve/CVE-2026-2303","hostname":"www.suse.com","tags":["WEB"]},{"url":"https://www.suse.com/security/cve/CVE-2026-39821","label":"www.suse.com/security/cve/CVE-2026-39821","hostname":"www.suse.com","tags":["WEB"]},{"url":"https://www.suse.com/security/cve/CVE-2026-40181","label":"www.suse.com/security/cve/CVE-2026-40181","hostname":"www.suse.com","tags":["WEB"]},{"url":"https://www.suse.com/security/cve/CVE-2026-42211","label":"www.suse.com/security/cve/CVE-2026-42211","hostname":"www.suse.com","tags":["WEB"]},{"url":"https://www.suse.com/security/cve/CVE-2026-42342","label":"www.suse.com/security/cve/CVE-2026-42342","hostname":"www.suse.com","tags":["WEB"]},{"url":"https://www.suse.com/security/cve/CVE-2026-44990","label":"www.suse.com/security/cve/CVE-2026-44990","hostname":"www.suse.com","tags":["WEB"]},{"url":"https://www.suse.com/security/cve/CVE-2026-53606","label":"www.suse.com/security/cve/CVE-2026-53606","hostname":"www.suse.com","tags":["WEB"]},{"url":"https://www.suse.com/security/cve/CVE-2026-56852","label":"www.suse.com/security/cve/CVE-2026-56852","hostname":"www.suse.com","tags":["WEB"]}],"lineage":{"upstream":["CVE-2023-45289","CVE-2025-4673","CVE-2025-61686","CVE-2026-2303","CVE-2026-39821","CVE-2026-40181","CVE-2026-42211","CVE-2026-42342","CVE-2026-44990","CVE-2026-53606","CVE-2026-56852"],"downstream":[],"duplicates":[],"related":["CVE-2023-45289","CVE-2025-4673","CVE-2025-61686","CVE-2026-2303","CVE-2026-39821","CVE-2026-40181","CVE-2026-42211","CVE-2026-42342","CVE-2026-44990","CVE-2026-53606","CVE-2026-56852"]},"timeline":[{"kind":"published","date":"2026-10-09T12:30:05.000Z","label":"Published","detail":"Vulnerability first disclosed.","source":null},{"kind":"modified","date":"2026-10-10T09:30:06.444Z","label":"Last modified","detail":"Vulnerability information updated.","source":null}],"risk":{"score":0,"level":"minimal","profile":"Default","thresholds":{"critical":75,"high":50,"medium":25,"low":10}},"meta":{"dataAsOf":"2026-10-22T13:36:21.026Z","stale":false,"partial":false}}