Prometheus is an open-source monitoring system and time series database. Prior to versions 3.5.3 and 3.11.3, the remote read endpoint (/api/v1/read) does not validate the declared decoded length in a snappy-compressed request body before allocating memory. An unauthenticated attacker can send a small payload that causes a huge heap allocation per request. Under concurrent load this can exhaust available memory and crash the Prometheus process. This issue has been patched in versions 3.5.3 and 3.11.3.

The remote Redhat Enterprise Linux 9 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2026:36796 advisory.

    Red Hat Edge Manager (RHEM) provides simple, scalable, and security-focused     management of edge devices and applications. It supports image-mode RHEL and     container workloads that run on Podman/Docker or Kubernetes.

    RHEM is now available as a standalone feature, providing greater flexibility for     edge deployments. In addition to the standalone version, RHEM continues to be     offered as a plugin for the following platforms:

    Red Hat Advanced Cluster Management (RHACM): Extends fleet management to edge     devices.
    Red Hat Ansible Automation Platform (AAP): Integrates edge management with     Ansible automation.

    This integration enables organizations to optimize the management and     orchestration of their fleets of edge devices; whether its thousands of     dispersed retail point-of-sale systems or industrial machinery on remote factory     floors.

    Value for customers and partners:

    * This solution not only helps customers manage thousands of devices but helps     scale operations.
    * To manage large-scale deployments, customers need to be able to integrate with     their existing management systems, support remote configuration and over-the-air     updates, and collect telemetry data for advanced analytics.
    * Red Hat Edge Manager offers a simple and security-focused lifecycle     management, from onboarding to decommissioning of edge devices.

    This complete end-to-end solution empowers organizations to gain the most value     from the fleets of devices that generate data, all from a centralized location.

    Security fixes:

    * golang.org/x/crypto/ssh: Denial of Service via crafted SSH certificate (CVE-2026-39835)
    * golang.org/x/crypto/ssh: Denial of Service via resource leak from unsolicited SSH responses     (CVE-2026-39830)
    * golang.org/x/crypto/ssh: Denial of Service via crafted public key with excessive parameters     (CVE-2026-39829)
    * golang.org/x/crypto/ssh: Unauthorized command execution via discarded SSH permissions (CVE-2026-39828)
    * golang.org/x/crypto/ssh: Authorization bypass due to skipped source-address validation (CVE-2026-46595)
    * golang.org/x/crypto/ssh/agent: Security bypass due to improper handling of key restrictions     (CVE-2026-39832)
    * golang.org/x/crypto/ssh/knownhosts: Revocation bypass via unchecked SignatureKey (CVE-2026-42508)
    * golang.org/x/net/idna: Privilege escalation via incorrect Punycode label processing (CVE-2026-39821)
    * Go net package: Denial of Service via long CNAME response in LookupCNAME (CVE-2026-33811)
    * Go crypto/x509: Denial of Service via inefficient certificate chain validation (CVE-2026-32281)
    * Go crypto/x509: Certificate validation bypass due to incorrect DNS constraint application     (CVE-2026-33810)
    * Go crypto/tls: Denial of Service via multiple TLS 1.3 key update messages (CVE-2026-32283)
    * Go: Denial of Service vulnerability in certificate chain building (CVE-2026-32280)
    * Go crypto/x509: Incorrect enforcement of email constraints (CVE-2026-27137)
    * Go net/url: Incorrect parsing of IPv6 host literals (CVE-2026-25679)
    * golang: Denial of Service due to excessive resource consumption via crafted certificate (CVE-2025-61729)
    * github.com/jackc/pgx: Memory-safety vulnerability (CVE-2026-33815)
    * github.com/jackc/pgx: Memory-safety vulnerability (CVE-2026-33816)
    * gRPC-Go: Authorization bypass due to improper HTTP/2 path validation (CVE-2026-33186)
    * Prometheus: Information disclosure of Azure OAuth client secret via config API (CVE-2026-42151)
    * Prometheus: Denial of Service via uncontrolled memory allocation in remote read endpoint     (CVE-2026-42154)
    * Root.Chmod can follow symlinks out of the root (CVE-2026-32282)
    * Kubelet, CRI-O, kube-apiserver: Denial of Service via SPDY streaming code (CVE-2026-35469)

Tenable has extracted the preceding description block directly from the Red Hat Enterprise Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote AlmaLinux 9 host has a package installed that is affected by multiple vulnerabilities as referenced in the ALSA-2026:34359 advisory.

    * github.com/prometheus/prometheus: Prometheus: Denial of Service via uncontrolled memory allocation in     remote read endpoint (CVE-2026-42154)
      * github.com/prometheus/prometheus: Prometheus: Information disclosure of Azure OAuth client secret via     config API (CVE-2026-42151)
      * net: golang: Go net package: Denial of Service via long CNAME response in LookupCNAME (CVE-2026-33811)
      * golang.org/x/net/idna: golang: golang.org/x/net/idna: Privilege escalation via incorrect Punycode     label processing (CVE-2026-39821)
      * golang.org/x/net/html: golang.org/x/net/html: Arbitrary code execution via Cross-Site Scripting     (CVE-2026-25681)
      * crypto/x509: golang: golang crypto/x509: Denial of Service via excessive processing of DNS SAN entries     (CVE-2026-27145)

Tenable has extracted the preceding description block directly from the AlmaLinux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote AlmaLinux 10 host has a package installed that is affected by multiple vulnerabilities as referenced in the ALSA-2026:34357 advisory.

    * github.com/prometheus/prometheus: Prometheus: Denial of Service via uncontrolled memory allocation in     remote read endpoint (CVE-2026-42154)
      * github.com/prometheus/prometheus: Prometheus: Information disclosure of Azure OAuth client secret via     config API (CVE-2026-42151)
      * net: golang: Go net package: Denial of Service via long CNAME response in LookupCNAME (CVE-2026-33811)
      * golang.org/x/net/idna: golang: golang.org/x/net/idna: Privilege escalation via incorrect Punycode     label processing (CVE-2026-39821)
      * golang.org/x/net/html: golang.org/x/net/html: Arbitrary code execution via Cross-Site Scripting     (CVE-2026-25681)
      * crypto/x509: golang: golang crypto/x509: Denial of Service via excessive processing of DNS SAN entries     (CVE-2026-27145)

Tenable has extracted the preceding description block directly from the AlmaLinux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote RockyLinux 10 host has a package installed that is affected by multiple vulnerabilities as referenced in the RLSA-2026:34357 advisory.

    * github.com/prometheus/prometheus: Prometheus: Denial of Service via uncontrolled memory allocation in     remote read endpoint (CVE-2026-42154)

    * github.com/prometheus/prometheus: Prometheus: Information disclosure of Azure OAuth client secret via     config API (CVE-2026-42151)

    * net: golang: Go net package: Denial of Service via long CNAME response in LookupCNAME (CVE-2026-33811)

    * golang.org/x/net/idna: golang: golang.org/x/net/idna: Privilege escalation via incorrect Punycode label     processing (CVE-2026-39821)

    * golang.org/x/net/html: golang.org/x/net/html: Arbitrary code execution via Cross-Site Scripting     (CVE-2026-25681)

    * crypto/x509: golang: golang crypto/x509: Denial of Service via excessive processing of DNS SAN entries     (CVE-2026-27145)

Tenable has extracted the preceding description block directly from the RockyLinux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote RockyLinux 9 host has a package installed that is affected by multiple vulnerabilities as referenced in the RLSA-2026:34359 advisory.

    * github.com/prometheus/prometheus: Prometheus: Denial of Service via uncontrolled memory allocation in     remote read endpoint (CVE-2026-42154)

    * github.com/prometheus/prometheus: Prometheus: Information disclosure of Azure OAuth client secret via     config API (CVE-2026-42151)

    * net: golang: Go net package: Denial of Service via long CNAME response in LookupCNAME (CVE-2026-33811)

    * golang.org/x/net/idna: golang: golang.org/x/net/idna: Privilege escalation via incorrect Punycode label     processing (CVE-2026-39821)

    * golang.org/x/net/html: golang.org/x/net/html: Arbitrary code execution via Cross-Site Scripting     (CVE-2026-25681)

    * crypto/x509: golang: golang crypto/x509: Denial of Service via excessive processing of DNS SAN entries     (CVE-2026-27145)

Tenable has extracted the preceding description block directly from the RockyLinux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Redhat Enterprise Linux 10 host has a package installed that is affected by multiple vulnerabilities as referenced in the RHSA-2026:34357 advisory.

    Collector with the supported components for a Red Hat build of OpenTelemetry

    Security Fix(es):

    * github.com/prometheus/prometheus: Prometheus: Denial of Service via uncontrolled memory allocation in     remote read endpoint (CVE-2026-42154)

    * github.com/prometheus/prometheus: Prometheus: Information disclosure of Azure OAuth client secret via     config API (CVE-2026-42151)

    * net: golang: Go net package: Denial of Service via long CNAME response in LookupCNAME (CVE-2026-33811)

    * golang.org/x/net/idna: golang: golang.org/x/net/idna: Privilege escalation via incorrect Punycode label     processing (CVE-2026-39821)

    * golang.org/x/net/html: golang.org/x/net/html: Arbitrary code execution via Cross-Site Scripting     (CVE-2026-25681)

    * crypto/x509: golang: golang crypto/x509: Denial of Service via excessive processing of DNS SAN entries     (CVE-2026-27145)

    For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and     other related information, refer to the CVE page(s) listed in the References section.

Tenable has extracted the preceding description block directly from the Red Hat Enterprise Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Redhat Enterprise Linux 9 host has a package installed that is affected by multiple vulnerabilities as referenced in the RHSA-2026:34359 advisory.

    Collector with the supported components for a Red Hat build of OpenTelemetry

    Security Fix(es):

    * github.com/prometheus/prometheus: Prometheus: Denial of Service via uncontrolled memory allocation in     remote read endpoint (CVE-2026-42154)

    * github.com/prometheus/prometheus: Prometheus: Information disclosure of Azure OAuth client secret via     config API (CVE-2026-42151)

    * net: golang: Go net package: Denial of Service via long CNAME response in LookupCNAME (CVE-2026-33811)

    * golang.org/x/net/idna: golang: golang.org/x/net/idna: Privilege escalation via incorrect Punycode label     processing (CVE-2026-39821)

    * golang.org/x/net/html: golang.org/x/net/html: Arbitrary code execution via Cross-Site Scripting     (CVE-2026-25681)

    * crypto/x509: golang: golang crypto/x509: Denial of Service via excessive processing of DNS SAN entries     (CVE-2026-27145)

    For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and     other related information, refer to the CVE page(s) listed in the References section.

Tenable has extracted the preceding description block directly from the Red Hat Enterprise Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Fedora 44 host has a package installed that is affected by multiple vulnerabilities as referenced in the FEDORA-2026-ebaf2bfd71 advisory.

    Update to 3.12.0

Tenable has extracted the preceding description block directly from the Fedora security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Fedora 43 host has a package installed that is affected by multiple vulnerabilities as referenced in the FEDORA-2026-dfc0e362e6 advisory.

    Update to 3.12.0

Tenable has extracted the preceding description block directly from the Fedora security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

There are packages installed that are affected by a vulnerability referenced in the following CVE:

  - Prometheus is an open-source monitoring system and time series database. Prior to versions 3.5.3 and
    3.11.3, the remote read endpoint (/api/v1/read) does not validate the declared decoded length in a snappy-
    compressed request body before allocating memory. An unauthenticated attacker can send a small payload
    that causes a huge heap allocation per request. Under concurrent load this can exhaust available memory
    and crash the Prometheus process. This issue has been patched in versions 3.5.3 and 3.11.3.
    (CVE-2026-42154)

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.

  - Prometheus is an open-source monitoring system and time series database. Prior to versions 3.5.3 and     3.11.3, the remote read endpoint (/api/v1/read) does not validate the declared decoded length in a snappy-     compressed request body before allocating memory. An unauthenticated attacker can send a small payload     that causes a huge heap allocation per request. Under concurrent load this can exhaust available memory     and crash the Prometheus process. This issue has been patched in versions 3.5.3 and 3.11.3.
    (CVE-2026-42154)

Note that Nessus relies on the presence of the package as reported by the vendor.

There are packages installed that are affected by multiple vulnerabilities referenced in the following CVEs:

  - Prometheus is an open-source monitoring system and time series database. Versions 3.0 through 3.5.1 and
    3.6.0 through 3.11.1 have stored cross-site scripting vulnerabilities in multiple components of the
    Prometheus web UI where metric names and label values are injected into innerHTML without escaping. In
    both the Mantine UI and old React UI, chart tooltips on the Graph page render metric names containing
    HTML/JavaScript without sanitization. In the old React UI, the Metric Explorer fuzzy search results use
    dangerouslySetInnerHTML without escaping, and heatmap cell tooltips interpolate le label values without
    sanitization. With Prometheus v3.x defaulting to UTF-8 metric and label name validation, characters like
    <, >, and " are now valid in metric names and labels. An attacker who can inject metrics via a compromised
    scrape target, remote write, or OTLP receiver endpoint can execute arbitrary JavaScript in the browser of
    any Prometheus user who views the metric in the Graph UI, potentially enabling configuration exfiltration,
    data deletion, or Prometheus shutdown depending on enabled flags. This issue has been fixed in versions
    3.5.2 and 3.11.2. If developers are unable to immediately update, the following workarounds are
    recommended: ensure that the remote write receiver (--web.enable-remote-write-receiver) and the OTLP
    receiver (--web.enable-otlp-receiver) are not exposed to untrusted sources; verify that all scrape targets
    are trusted and not under attacker control; avoid enabling admin or mutating API endpoints (e.g.,
    --web.enable-admin-api or --web.enable-lifecycle) in environments where untrusted data may be ingested;
    and refrain from clicking untrusted links, particularly those containing functions such as label_replace,
    as they may generate poisoned label names and values. (CVE-2026-40179)

  - Prometheus is an open-source monitoring system and time series database. Prior to versions 3.5.3 and
    3.11.3, the client_secret field in the Azure AD remote write OAuth configuration (storage/remote/azuread)
    was typed as string instead of Secret. Prometheus redacts fields of type Secret when serving the
    configuration via the /-/config HTTP API endpoint. Because the field was a plain string, the Azure OAuth
    client secret was exposed in plaintext to any user or process with access to that endpoint. This issue has
    been patched in versions 3.5.3 and 3.11.3. (CVE-2026-42151)

  - Prometheus is an open-source monitoring system and time series database. Prior to versions 3.5.3 and
    3.11.3, the remote read endpoint (/api/v1/read) does not validate the declared decoded length in a snappy-
    compressed request body before allocating memory. An unauthenticated attacker can send a small payload
    that causes a huge heap allocation per request. Under concurrent load this can exhaust available memory
    and crash the Prometheus process. This issue has been patched in versions 3.5.3 and 3.11.3.
    (CVE-2026-42154)

ID	Name	Product	Family	Severity
325733	RHEL 9 : Red Hat Edge Manager Version 1.0.3 Security Update (Important) (RHSA-2026:36796)	Nessus	Red Hat Local Security Checks	high
325497	AlmaLinux 9 : opentelemetry-collector (ALSA-2026:34359)	Nessus	Alma Linux Local Security Checks	high
325496	AlmaLinux 10 : opentelemetry-collector (ALSA-2026:34357)	Nessus	Alma Linux Local Security Checks	high
325384	RockyLinux 10 : opentelemetry-collector (RLSA-2026:34357)	Nessus	Rocky Linux Local Security Checks	high
325275	RockyLinux 9 : opentelemetry-collector (RLSA-2026:34359)	Nessus	Rocky Linux Local Security Checks	high
324605	RHEL 10 : opentelemetry-collector (RHSA-2026:34357)	Nessus	Red Hat Local Security Checks	high
324597	RHEL 9 : opentelemetry-collector (RHSA-2026:34359)	Nessus	Red Hat Local Security Checks	high
322124	Fedora 44 : prometheus (2026-ebaf2bfd71)	Nessus	Fedora Local Security Checks	low
322122	Fedora 43 : prometheus (2026-dfc0e362e6)	Nessus	Fedora Local Security Checks	low
441244	SCA: security update for github.com/prometheus/prometheus (GHSA-8rm2-7qqf-34qm)	Tenable Cloud Security	SCA Checks	high
441244	SCA: security update for github.com/prometheus/prometheus (GHSA-8rm2-7qqf-34qm)	Tenable Self-Hosted Container Security	SCA Checks	high
312612	Linux Distros Unpatched Vulnerability : CVE-2026-42154	Nessus	Misc.	high
441027	Alpine: multiple prometheus packages: security update to 3.5.3-r0	Tenable Cloud Security	Alpine Linux Local Security Checks	medium
441027	Alpine: multiple prometheus packages: security update to 3.5.3-r0	Tenable Self-Hosted Container Security	Alpine Linux Local Security Checks	medium

Detections

Analytics

CVE-2026-42154

high

Tenable Plugins

high

high

high

high

high

high

high

low

low

high

high

high

medium

medium