Prometheus is an open-source monitoring system and time series database. Prior to versions 3.5.3 and 3.11.3, the remote read endpoint (/api/v1/read) does not validate the declared decoded length in a snappy-compressed request body before allocating memory. An unauthenticated attacker can send a small payload that causes a huge heap allocation per request. Under concurrent load this can exhaust available memory and crash the Prometheus process. This issue has been patched in versions 3.5.3 and 3.11.3.

The remote Redhat Enterprise Linux 10 / 9 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2026:41019 advisory.

    Red Hat Edge Manager (RHEM) provides simple, scalable, and security-focused     management of edge devices and applications. It supports image-mode RHEL and     container workloads that run on Podman/Docker or Kubernetes.

    RHEM is now available as a standalone feature, providing greater flexibility for     edge deployments. In addition to the standalone version, RHEM continues to be     offered as a plugin for the following platforms:

    Red Hat Advanced Cluster Management (RHACM): Extends fleet management to edge     devices.
    Red Hat Ansible Automation Platform (AAP): Integrates edge management with     Ansible automation.

    This integration enables organizations to optimize the management and     orchestration of their fleets of edge devices; whether its thousands of     dispersed retail point-of-sale systems or industrial machinery on remote factory     floors.

    Value for customers and partners:

    * This solution not only helps customers manage thousands of devices but helps     scale operations.
    * To manage large-scale deployments, customers need to be able to integrate with     their existing management systems, support remote configuration and over-the-air     updates, and collect telemetry data for advanced analytics.
    * Red Hat Edge Manager offers a simple and security-focused lifecycle     management, from onboarding to decommissioning of edge devices.

    This complete end-to-end solution empowers organizations to gain the most value     from the fleets of devices that generate data, all from a centralized location.

    Security fixes:

    * golang.org/x/crypto/ssh: Denial of Service via crafted SSH certificate (CVE-2026-39835)
    * golang.org/x/crypto/ssh: Denial of Service via resource leak from unsolicited SSH responses     (CVE-2026-39830)
    * golang.org/x/crypto/ssh: Denial of Service via crafted public key with excessive parameters     (CVE-2026-39829)
    * golang.org/x/crypto/ssh: Unauthorized command execution via discarded SSH permissions (CVE-2026-39828)
    * golang.org/x/crypto/ssh: Authorization bypass due to skipped source-address validation (CVE-2026-46595)
    * golang.org/x/crypto/ssh/agent: Security bypass due to improper handling of key restrictions     (CVE-2026-39832)
    * golang.org/x/crypto/ssh/knownhosts: Revocation bypass via unchecked SignatureKey (CVE-2026-42508)
    * golang.org/x/net/idna: Privilege escalation via incorrect Punycode label processing (CVE-2026-39821)
    * Go net package: Denial of Service via long CNAME response in LookupCNAME (CVE-2026-33811)
    * Go crypto/x509: Denial of Service via inefficient certificate chain validation (CVE-2026-32281)
    * Go crypto/tls: Denial of Service via multiple TLS 1.3 key update messages (CVE-2026-32283)
    * Go: Denial of Service vulnerability in certificate chain building (CVE-2026-32280)
    * Go crypto/x509: Incorrect enforcement of email constraints (CVE-2026-27137)
    * Go net/url: Incorrect parsing of IPv6 host literals (CVE-2026-25679)
    * golang: Denial of Service due to excessive resource consumption via crafted certificate (CVE-2025-61729)
    * github.com/jackc/pgx: Memory-safety vulnerability (CVE-2026-33816)
    * github.com/jackc/pgx: Memory-safety vulnerability (CVE-2026-33815)
    * gRPC-Go: Authorization bypass due to improper HTTP/2 path validation (CVE-2026-33186)
    * Prometheus: Information disclosure of Azure OAuth client secret via config API (CVE-2026-42151)
    * Prometheus: Denial of Service via uncontrolled memory allocation in remote read endpoint     (CVE-2026-42154)
    * Root.Chmod can follow symlinks out of the root (CVE-2026-32282)
    * Kubelet, CRI-O, kube-apiserver: Denial of Service via SPDY streaming code (CVE-2026-35469)

Tenable has extracted the preceding description block directly from the Red Hat Enterprise Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Redhat Enterprise Linux 9 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2026:36796 advisory.

    Red Hat Edge Manager (RHEM) provides simple, scalable, and security-focused     management of edge devices and applications. It supports image-mode RHEL and     container workloads that run on Podman/Docker or Kubernetes.

    RHEM is now available as a standalone feature, providing greater flexibility for     edge deployments. In addition to the standalone version, RHEM continues to be     offered as a plugin for the following platforms:

    Red Hat Advanced Cluster Management (RHACM): Extends fleet management to edge     devices.
    Red Hat Ansible Automation Platform (AAP): Integrates edge management with     Ansible automation.

    This integration enables organizations to optimize the management and     orchestration of their fleets of edge devices; whether its thousands of     dispersed retail point-of-sale systems or industrial machinery on remote factory     floors.

    Value for customers and partners:

    * This solution not only helps customers manage thousands of devices but helps     scale operations.
    * To manage large-scale deployments, customers need to be able to integrate with     their existing management systems, support remote configuration and over-the-air     updates, and collect telemetry data for advanced analytics.
    * Red Hat Edge Manager offers a simple and security-focused lifecycle     management, from onboarding to decommissioning of edge devices.

    This complete end-to-end solution empowers organizations to gain the most value     from the fleets of devices that generate data, all from a centralized location.

    Security fixes:

    * golang.org/x/crypto/ssh: Denial of Service via crafted SSH certificate (CVE-2026-39835)
    * golang.org/x/crypto/ssh: Denial of Service via resource leak from unsolicited SSH responses     (CVE-2026-39830)
    * golang.org/x/crypto/ssh: Denial of Service via crafted public key with excessive parameters     (CVE-2026-39829)
    * golang.org/x/crypto/ssh: Unauthorized command execution via discarded SSH permissions (CVE-2026-39828)
    * golang.org/x/crypto/ssh: Authorization bypass due to skipped source-address validation (CVE-2026-46595)
    * golang.org/x/crypto/ssh/agent: Security bypass due to improper handling of key restrictions     (CVE-2026-39832)
    * golang.org/x/crypto/ssh/knownhosts: Revocation bypass via unchecked SignatureKey (CVE-2026-42508)
    * golang.org/x/net/idna: Privilege escalation via incorrect Punycode label processing (CVE-2026-39821)
    * Go net package: Denial of Service via long CNAME response in LookupCNAME (CVE-2026-33811)
    * Go crypto/x509: Denial of Service via inefficient certificate chain validation (CVE-2026-32281)
    * Go crypto/x509: Certificate validation bypass due to incorrect DNS constraint application     (CVE-2026-33810)
    * Go crypto/tls: Denial of Service via multiple TLS 1.3 key update messages (CVE-2026-32283)
    * Go: Denial of Service vulnerability in certificate chain building (CVE-2026-32280)
    * Go crypto/x509: Incorrect enforcement of email constraints (CVE-2026-27137)
    * Go net/url: Incorrect parsing of IPv6 host literals (CVE-2026-25679)
    * golang: Denial of Service due to excessive resource consumption via crafted certificate (CVE-2025-61729)
    * github.com/jackc/pgx: Memory-safety vulnerability (CVE-2026-33815)
    * github.com/jackc/pgx: Memory-safety vulnerability (CVE-2026-33816)
    * gRPC-Go: Authorization bypass due to improper HTTP/2 path validation (CVE-2026-33186)
    * Prometheus: Information disclosure of Azure OAuth client secret via config API (CVE-2026-42151)
    * Prometheus: Denial of Service via uncontrolled memory allocation in remote read endpoint     (CVE-2026-42154)
    * Root.Chmod can follow symlinks out of the root (CVE-2026-32282)
    * Kubelet, CRI-O, kube-apiserver: Denial of Service via SPDY streaming code (CVE-2026-35469)

Tenable has extracted the preceding description block directly from the Red Hat Enterprise Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote AlmaLinux 9 host has a package installed that is affected by multiple vulnerabilities as referenced in the ALSA-2026:34359 advisory.

    * github.com/prometheus/prometheus: Prometheus: Denial of Service via uncontrolled memory allocation in     remote read endpoint (CVE-2026-42154)
      * github.com/prometheus/prometheus: Prometheus: Information disclosure of Azure OAuth client secret via     config API (CVE-2026-42151)
      * net: golang: Go net package: Denial of Service via long CNAME response in LookupCNAME (CVE-2026-33811)
      * golang.org/x/net/idna: golang: golang.org/x/net/idna: Privilege escalation via incorrect Punycode     label processing (CVE-2026-39821)
      * golang.org/x/net/html: golang.org/x/net/html: Arbitrary code execution via Cross-Site Scripting     (CVE-2026-25681)
      * crypto/x509: golang: golang crypto/x509: Denial of Service via excessive processing of DNS SAN entries     (CVE-2026-27145)

Tenable has extracted the preceding description block directly from the AlmaLinux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote AlmaLinux 10 host has a package installed that is affected by multiple vulnerabilities as referenced in the ALSA-2026:34357 advisory.

    * github.com/prometheus/prometheus: Prometheus: Denial of Service via uncontrolled memory allocation in     remote read endpoint (CVE-2026-42154)
      * github.com/prometheus/prometheus: Prometheus: Information disclosure of Azure OAuth client secret via     config API (CVE-2026-42151)
      * net: golang: Go net package: Denial of Service via long CNAME response in LookupCNAME (CVE-2026-33811)
      * golang.org/x/net/idna: golang: golang.org/x/net/idna: Privilege escalation via incorrect Punycode     label processing (CVE-2026-39821)
      * golang.org/x/net/html: golang.org/x/net/html: Arbitrary code execution via Cross-Site Scripting     (CVE-2026-25681)
      * crypto/x509: golang: golang crypto/x509: Denial of Service via excessive processing of DNS SAN entries     (CVE-2026-27145)

Tenable has extracted the preceding description block directly from the AlmaLinux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote RockyLinux 10 host has a package installed that is affected by multiple vulnerabilities as referenced in the RLSA-2026:34357 advisory.

    * github.com/prometheus/prometheus: Prometheus: Denial of Service via uncontrolled memory allocation in     remote read endpoint (CVE-2026-42154)

    * github.com/prometheus/prometheus: Prometheus: Information disclosure of Azure OAuth client secret via     config API (CVE-2026-42151)

    * net: golang: Go net package: Denial of Service via long CNAME response in LookupCNAME (CVE-2026-33811)

    * golang.org/x/net/idna: golang: golang.org/x/net/idna: Privilege escalation via incorrect Punycode label     processing (CVE-2026-39821)

    * golang.org/x/net/html: golang.org/x/net/html: Arbitrary code execution via Cross-Site Scripting     (CVE-2026-25681)

    * crypto/x509: golang: golang crypto/x509: Denial of Service via excessive processing of DNS SAN entries     (CVE-2026-27145)

Tenable has extracted the preceding description block directly from the RockyLinux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote RockyLinux 9 host has a package installed that is affected by multiple vulnerabilities as referenced in the RLSA-2026:34359 advisory.

    * github.com/prometheus/prometheus: Prometheus: Denial of Service via uncontrolled memory allocation in     remote read endpoint (CVE-2026-42154)

    * github.com/prometheus/prometheus: Prometheus: Information disclosure of Azure OAuth client secret via     config API (CVE-2026-42151)

    * net: golang: Go net package: Denial of Service via long CNAME response in LookupCNAME (CVE-2026-33811)

    * golang.org/x/net/idna: golang: golang.org/x/net/idna: Privilege escalation via incorrect Punycode label     processing (CVE-2026-39821)

    * golang.org/x/net/html: golang.org/x/net/html: Arbitrary code execution via Cross-Site Scripting     (CVE-2026-25681)

    * crypto/x509: golang: golang crypto/x509: Denial of Service via excessive processing of DNS SAN entries     (CVE-2026-27145)

Tenable has extracted the preceding description block directly from the RockyLinux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Redhat Enterprise Linux 10 host has a package installed that is affected by multiple vulnerabilities as referenced in the RHSA-2026:34357 advisory.

    Collector with the supported components for a Red Hat build of OpenTelemetry

    Security Fix(es):

    * github.com/prometheus/prometheus: Prometheus: Denial of Service via uncontrolled memory allocation in     remote read endpoint (CVE-2026-42154)

    * github.com/prometheus/prometheus: Prometheus: Information disclosure of Azure OAuth client secret via     config API (CVE-2026-42151)

    * net: golang: Go net package: Denial of Service via long CNAME response in LookupCNAME (CVE-2026-33811)

    * golang.org/x/net/idna: golang: golang.org/x/net/idna: Privilege escalation via incorrect Punycode label     processing (CVE-2026-39821)

    * golang.org/x/net/html: golang.org/x/net/html: Arbitrary code execution via Cross-Site Scripting     (CVE-2026-25681)

    * crypto/x509: golang: golang crypto/x509: Denial of Service via excessive processing of DNS SAN entries     (CVE-2026-27145)

    For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and     other related information, refer to the CVE page(s) listed in the References section.

Tenable has extracted the preceding description block directly from the Red Hat Enterprise Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Redhat Enterprise Linux 9 host has a package installed that is affected by multiple vulnerabilities as referenced in the RHSA-2026:34359 advisory.

    Collector with the supported components for a Red Hat build of OpenTelemetry

    Security Fix(es):

    * github.com/prometheus/prometheus: Prometheus: Denial of Service via uncontrolled memory allocation in     remote read endpoint (CVE-2026-42154)

    * github.com/prometheus/prometheus: Prometheus: Information disclosure of Azure OAuth client secret via     config API (CVE-2026-42151)

    * net: golang: Go net package: Denial of Service via long CNAME response in LookupCNAME (CVE-2026-33811)

    * golang.org/x/net/idna: golang: golang.org/x/net/idna: Privilege escalation via incorrect Punycode label     processing (CVE-2026-39821)

    * golang.org/x/net/html: golang.org/x/net/html: Arbitrary code execution via Cross-Site Scripting     (CVE-2026-25681)

    * crypto/x509: golang: golang crypto/x509: Denial of Service via excessive processing of DNS SAN entries     (CVE-2026-27145)

    For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and     other related information, refer to the CVE page(s) listed in the References section.

Tenable has extracted the preceding description block directly from the Red Hat Enterprise Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Fedora 44 host has a package installed that is affected by multiple vulnerabilities as referenced in the FEDORA-2026-ebaf2bfd71 advisory.

    Update to 3.12.0

Tenable has extracted the preceding description block directly from the Fedora security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Fedora 43 host has a package installed that is affected by multiple vulnerabilities as referenced in the FEDORA-2026-dfc0e362e6 advisory.

    Update to 3.12.0

Tenable has extracted the preceding description block directly from the Fedora security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The version of amazon-cloudwatch-agent installed on the remote host is prior to 1.300066.2-2. It is, therefore, affected by multiple vulnerabilities as referenced in the ALAS2-2026-3323 advisory.

    Arithmetic over induction variables in loops were not correctly checked for underflow or overflow in the     Go compiler (cmd/compile). As a result, the compiler would allow for invalid indexing to occur at runtime,     potentially leading to memory corruption in programs compiled with affected Go versions. (CVE-2026-27143)

    The Go compiler (cmd/compile) incorrectly handled no-op interface conversions, preventing correct     determination about non-overlapping memory moves, potentially leading to memory corruption at runtime in     programs compiled with affected Go versions. (CVE-2026-27144)

    During chain building, the amount of work that is done is not correctly limited when a large number of     intermediate certificates are passed in VerifyOptions.Intermediates, which can lead to a denial of     service. This affects both direct users of crypto/x509 and users of crypto/tls. (CVE-2026-32280)

    Validating certificate chains which use policies is unexpectedly inefficient when certificates in the     chain contain a very large number of policy mappings, possibly causing denial of service. This only     affects validation of otherwise trusted certificate chains, issued by a root CA in the VerifyOptions.Roots     CertPool, or in the system certificate pool. (CVE-2026-32281)

    On Linux, if the target of Root.Chmod is replaced with a symlink while the chmod operation is in progress,     Chmod can operate on the target of the symlink, even when the target lies outside the root.
    (CVE-2026-32282)

    If one side of the TLS connection sends multiple key update messages post-handshake in a single record,     the connection can deadlock, causing uncontrolled consumption of resources. This can lead to a denial of     service. This only affects TLS 1.3. (CVE-2026-32283)

    Boolean XPath expressions that evaluate to true can cause an infinite loop in logicalQuery.Select, leading     to 100% CPU usage. This can be triggered by top-level selectors such as 1=1 or true().
    (CVE-2026-32287)

    tar.Reader can allocate an unbounded amount of memory when reading a maliciously-crafted archive     containing a large number of sparse regions encoded in the old GNU sparse map format. (CVE-2026-32288)

    Context was not properly tracked across template branches for JS template literals, leading to possibly     incorrect escaping of content. This could cause actions within JS template literals to be incorrectly     escaped, leading to XSS vulnerabilities. (CVE-2026-32289)

    When using LookupCNAME with the cgo DNS resolver, a very long CNAME response can trigger a double-free of     C memory and a crash. (CVE-2026-33811)

    When processing HTTP/2 SETTINGS frames, transport will enter an infinite loop of writing CONTINUATION     frames if it receives a SETTINGS_MAX_FRAME_SIZE with a value of 0. (CVE-2026-33814)

    Well-crafted inputs reaching ParseAddress, ParseAddressList, and ParseDate were able to trigger excessive     CPU exhaustion and memory allocations. (CVE-2026-39820)

    CVE-2026-27142 fixed a vulnerability in which URLs were not correctly escaped inside of a <meta> tag's     <content> attribute. If the URL content were to insert ASCII whitespaces around the '=' rune inside of the     <content> attribute, the escaper would fail to similarly escape it, leading to XSS. (CVE-2026-39823)

    ReverseProxy can forward queries containing parameters not visible to Rewrite functions. When used with a     Rewrite function, or a Director function which parses query parameters, ReverseProxy sanitizes the     forwarded request to remove query parameters which are not parsed by url.ParseQuery. ReverseProxy does not     take ParseQuery's limit on the total number of query parameters (controlled by     GODEBUG=urlmaxqueryparams=N) into account. This can permit ReverseProxy to forward a request containing a     query parameter that is not visible to the Rewrite function. For example, the query     a1=x&a2=x&...&a10000=x&hidden=y can forward the parameter hidden=y while hiding it from the proxy's     Rewrite function. (CVE-2026-39825)

    If a trusted template author were to write a <script> tag containing an empty 'type' attribute or a 'type'     attribute with an ASCII whitespace, the execution of the template would incorrectly escape any data passed     into the <script> block. (CVE-2026-39826)

    OpenTelemetry-Go is the Go implementation of OpenTelemetry. Prior to 1.43.0, the otlp HTTP exporters     (traces/metrics/logs) read the full HTTP response body into an in-memory bytes.Buffer without a size cap.
    This is exploitable for memory exhaustion when the configured collector endpoint is attacker-controlled     (or a network attacker can mitm the exporter connection). This vulnerability is fixed in 1.43.0.
    (CVE-2026-39882)

    Integer Overflow or Wraparound vulnerability in Apache Thrift TFramedTransport Go language implementation

    This issue affects Apache Thrift: before 0.23.0.

    Users are recommended to upgrade to version 0.23.0, which fixes the issue. (CVE-2026-41602)

    Prometheus is an open-source monitoring system and time series database. Prior to versions 3.5.3 and     3.11.3, the remote read endpoint (/api/v1/read) does not validate the declared decoded length in a snappy-     compressed request body before allocating memory. An unauthenticated attacker can send a small payload     that causes a huge heap allocation per request. Under concurrent load this can exhaust available memory     and crash the Prometheus process. This issue has been patched in versions 3.5.3 and 3.11.3.
    (CVE-2026-42154)

    Pathological inputs could cause DoS through consumePhrase when parsing an email address according to RFC     5322. (CVE-2026-42499)

Tenable has extracted the preceding description block directly from the tested product security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

It is, therefore, affected by multiple vulnerabilities as referenced in the ALAS2023-2026-1747 advisory.

    Arithmetic over induction variables in loops were not correctly checked for underflow or overflow in the     Go compiler (cmd/compile). As a result, the compiler would allow for invalid indexing to occur at runtime,     potentially leading to memory corruption in programs compiled with affected Go versions. (CVE-2026-27143)

    The Go compiler (cmd/compile) incorrectly handled no-op interface conversions, preventing correct     determination about non-overlapping memory moves, potentially leading to memory corruption at runtime in     programs compiled with affected Go versions. (CVE-2026-27144)

    During chain building, the amount of work that is done is not correctly limited when a large number of     intermediate certificates are passed in VerifyOptions.Intermediates, which can lead to a denial of     service. This affects both direct users of crypto/x509 and users of crypto/tls. (CVE-2026-32280)

    Validating certificate chains which use policies is unexpectedly inefficient when certificates in the     chain contain a very large number of policy mappings, possibly causing denial of service. This only     affects validation of otherwise trusted certificate chains, issued by a root CA in the VerifyOptions.Roots     CertPool, or in the system certificate pool. (CVE-2026-32281)

    On Linux, if the target of Root.Chmod is replaced with a symlink while the chmod operation is in progress,     Chmod can operate on the target of the symlink, even when the target lies outside the root.
    (CVE-2026-32282)

    If one side of the TLS connection sends multiple key update messages post-handshake in a single record,     the connection can deadlock, causing uncontrolled consumption of resources. This can lead to a denial of     service. This only affects TLS 1.3. (CVE-2026-32283)

    Boolean XPath expressions that evaluate to true can cause an infinite loop in logicalQuery.Select, leading     to 100% CPU usage. This can be triggered by top-level selectors such as 1=1 or true().
    (CVE-2026-32287)

    tar.Reader can allocate an unbounded amount of memory when reading a maliciously-crafted archive     containing a large number of sparse regions encoded in the old GNU sparse map format. (CVE-2026-32288)

    Context was not properly tracked across template branches for JS template literals, leading to possibly     incorrect escaping of content. This could cause actions within JS template literals to be incorrectly     escaped, leading to XSS vulnerabilities. (CVE-2026-32289)

    When using LookupCNAME with the cgo DNS resolver, a very long CNAME response can trigger a double-free of     C memory and a crash. (CVE-2026-33811)

    When processing HTTP/2 SETTINGS frames, transport will enter an infinite loop of writing CONTINUATION     frames if it receives a SETTINGS_MAX_FRAME_SIZE with a value of 0. (CVE-2026-33814)

    Well-crafted inputs reaching ParseAddress, ParseAddressList, and ParseDate were able to trigger excessive     CPU exhaustion and memory allocations. (CVE-2026-39820)

    CVE-2026-27142 fixed a vulnerability in which URLs were not correctly escaped inside of a <meta> tag's     <content> attribute. If the URL content were to insert ASCII whitespaces around the '=' rune inside of the     <content> attribute, the escaper would fail to similarly escape it, leading to XSS. (CVE-2026-39823)

    ReverseProxy can forward queries containing parameters not visible to Rewrite functions. When used with a     Rewrite function, or a Director function which parses query parameters, ReverseProxy sanitizes the     forwarded request to remove query parameters which are not parsed by url.ParseQuery. ReverseProxy does not     take ParseQuery's limit on the total number of query parameters (controlled by     GODEBUG=urlmaxqueryparams=N) into account. This can permit ReverseProxy to forward a request containing a     query parameter that is not visible to the Rewrite function. For example, the query     a1=x&a2=x&...&a10000=x&hidden=y can forward the parameter hidden=y while hiding it from the proxy's     Rewrite function. (CVE-2026-39825)

    If a trusted template author were to write a <script> tag containing an empty 'type' attribute or a 'type'     attribute with an ASCII whitespace, the execution of the template would incorrectly escape any data passed     into the <script> block. (CVE-2026-39826)

    OpenTelemetry-Go is the Go implementation of OpenTelemetry. Prior to 1.43.0, the otlp HTTP exporters     (traces/metrics/logs) read the full HTTP response body into an in-memory bytes.Buffer without a size cap.
    This is exploitable for memory exhaustion when the configured collector endpoint is attacker-controlled     (or a network attacker can mitm the exporter connection). This vulnerability is fixed in 1.43.0.
    (CVE-2026-39882)

    Integer Overflow or Wraparound vulnerability in Apache Thrift TFramedTransport Go language implementation

    This issue affects Apache Thrift: before 0.23.0.

    Users are recommended to upgrade to version 0.23.0, which fixes the issue. (CVE-2026-41602)

    Prometheus is an open-source monitoring system and time series database. Prior to versions 3.5.3 and     3.11.3, the remote read endpoint (/api/v1/read) does not validate the declared decoded length in a snappy-     compressed request body before allocating memory. An unauthenticated attacker can send a small payload     that causes a huge heap allocation per request. Under concurrent load this can exhaust available memory     and crash the Prometheus process. This issue has been patched in versions 3.5.3 and 3.11.3.
    (CVE-2026-42154)

    Pathological inputs could cause DoS through consumePhrase when parsing an email address according to RFC     5322. (CVE-2026-42499)

Tenable has extracted the preceding description block directly from the tested product security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

There are packages installed that are affected by a vulnerability referenced in the following CVE:

  - Prometheus is an open-source monitoring system and time series database. Prior to versions 3.5.3 and
    3.11.3, the remote read endpoint (/api/v1/read) does not validate the declared decoded length in a snappy-
    compressed request body before allocating memory. An unauthenticated attacker can send a small payload
    that causes a huge heap allocation per request. Under concurrent load this can exhaust available memory
    and crash the Prometheus process. This issue has been patched in versions 3.5.3 and 3.11.3.
    (CVE-2026-42154)

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.

  - Prometheus is an open-source monitoring system and time series database. Prior to versions 3.5.3 and     3.11.3, the remote read endpoint (/api/v1/read) does not validate the declared decoded length in a snappy-     compressed request body before allocating memory. An unauthenticated attacker can send a small payload     that causes a huge heap allocation per request. Under concurrent load this can exhaust available memory     and crash the Prometheus process. This issue has been patched in versions 3.5.3 and 3.11.3.
    (CVE-2026-42154)

Note that Nessus relies on the presence of the package as reported by the vendor.

There are packages installed that are affected by multiple vulnerabilities referenced in the following CVEs:

  - Prometheus is an open-source monitoring system and time series database. Versions 3.0 through 3.5.1 and
    3.6.0 through 3.11.1 have stored cross-site scripting vulnerabilities in multiple components of the
    Prometheus web UI where metric names and label values are injected into innerHTML without escaping. In
    both the Mantine UI and old React UI, chart tooltips on the Graph page render metric names containing
    HTML/JavaScript without sanitization. In the old React UI, the Metric Explorer fuzzy search results use
    dangerouslySetInnerHTML without escaping, and heatmap cell tooltips interpolate le label values without
    sanitization. With Prometheus v3.x defaulting to UTF-8 metric and label name validation, characters like
    <, >, and " are now valid in metric names and labels. An attacker who can inject metrics via a compromised
    scrape target, remote write, or OTLP receiver endpoint can execute arbitrary JavaScript in the browser of
    any Prometheus user who views the metric in the Graph UI, potentially enabling configuration exfiltration,
    data deletion, or Prometheus shutdown depending on enabled flags. This issue has been fixed in versions
    3.5.2 and 3.11.2. If developers are unable to immediately update, the following workarounds are
    recommended: ensure that the remote write receiver (--web.enable-remote-write-receiver) and the OTLP
    receiver (--web.enable-otlp-receiver) are not exposed to untrusted sources; verify that all scrape targets
    are trusted and not under attacker control; avoid enabling admin or mutating API endpoints (e.g.,
    --web.enable-admin-api or --web.enable-lifecycle) in environments where untrusted data may be ingested;
    and refrain from clicking untrusted links, particularly those containing functions such as label_replace,
    as they may generate poisoned label names and values. (CVE-2026-40179)

  - Prometheus is an open-source monitoring system and time series database. Prior to versions 3.5.3 and
    3.11.3, the client_secret field in the Azure AD remote write OAuth configuration (storage/remote/azuread)
    was typed as string instead of Secret. Prometheus redacts fields of type Secret when serving the
    configuration via the /-/config HTTP API endpoint. Because the field was a plain string, the Azure OAuth
    client secret was exposed in plaintext to any user or process with access to that endpoint. This issue has
    been patched in versions 3.5.3 and 3.11.3. (CVE-2026-42151)

  - Prometheus is an open-source monitoring system and time series database. Prior to versions 3.5.3 and
    3.11.3, the remote read endpoint (/api/v1/read) does not validate the declared decoded length in a snappy-
    compressed request body before allocating memory. An unauthenticated attacker can send a small payload
    that causes a huge heap allocation per request. Under concurrent load this can exhaust available memory
    and crash the Prometheus process. This issue has been patched in versions 3.5.3 and 3.11.3.
    (CVE-2026-42154)

ID	Name	Product	Family	Severity
327424	RHEL 10 / 9 : Red Hat Edge Manager Version 1.1.3 Security Update (Important) (RHSA-2026:41019)	Nessus	Red Hat Local Security Checks	high
325733	RHEL 9 : Red Hat Edge Manager Version 1.0.3 Security Update (Important) (RHSA-2026:36796)	Nessus	Red Hat Local Security Checks	high
325497	AlmaLinux 9 : opentelemetry-collector (ALSA-2026:34359)	Nessus	Alma Linux Local Security Checks	high
325496	AlmaLinux 10 : opentelemetry-collector (ALSA-2026:34357)	Nessus	Alma Linux Local Security Checks	high
325384	RockyLinux 10 : opentelemetry-collector (RLSA-2026:34357)	Nessus	Rocky Linux Local Security Checks	high
325275	RockyLinux 9 : opentelemetry-collector (RLSA-2026:34359)	Nessus	Rocky Linux Local Security Checks	high
324605	RHEL 10 : opentelemetry-collector (RHSA-2026:34357)	Nessus	Red Hat Local Security Checks	high
324597	RHEL 9 : opentelemetry-collector (RHSA-2026:34359)	Nessus	Red Hat Local Security Checks	high
322124	Fedora 44 : prometheus (2026-ebaf2bfd71)	Nessus	Fedora Local Security Checks	low
322122	Fedora 43 : prometheus (2026-dfc0e362e6)	Nessus	Fedora Local Security Checks	low
319860	Amazon Linux 2 : amazon-cloudwatch-agent, --advisory ALAS2-2026-3323 (ALAS-2026-3323)	Nessus	Amazon Linux Local Security Checks	critical
316992	Amazon Linux 2023 : amazon-cloudwatch-agent (ALAS2023-2026-1747)	Nessus	Amazon Linux Local Security Checks	critical
441244	SCA: security update for github.com/prometheus/prometheus (GHSA-8rm2-7qqf-34qm)	Tenable Cloud Security	SCA Checks	high
441244	SCA: security update for github.com/prometheus/prometheus (GHSA-8rm2-7qqf-34qm)	Tenable Self-Hosted Container Security	SCA Checks	high
312612	Linux Distros Unpatched Vulnerability : CVE-2026-42154	Nessus	Misc.	high
441027	Alpine: multiple prometheus packages: security update to 3.5.3-r0	Tenable Cloud Security	Alpine Linux Local Security Checks	medium
441027	Alpine: multiple prometheus packages: security update to 3.5.3-r0	Tenable Self-Hosted Container Security	Alpine Linux Local Security Checks	medium

Detections

Analytics

CVE-2026-42154

high

Tenable Plugins

high

high

high

high

high

high

high

high

low

low

critical

critical

high

high

high

medium

medium