CVE-2026-42154
Published: 04 May 2026
Summary
CVE-2026-42154 is a high-severity Uncontrolled Resource Consumption (CWE-400) vulnerability in Prometheus Prometheus. Its CVSS base score is 7.5 (High).
Operationally, exploitation aligns with the MITRE ATT&CK technique Application or System Exploitation (T1499.004); ranked at the 6.5th percentile by exploit likelihood (below the median); it is not currently listed in the CISA KEV catalog.
The strongest mitigations our analysis identified are NIST 800-53 SC-5 (Denial-of-service Protection) and SI-10 (Information Input Validation).
Deeper analysis
CVE-2026-42154 is a memory allocation vulnerability in Prometheus, an open-source monitoring system and time series database. In versions prior to 3.5.3 and 3.11.3, the remote read endpoint (/api/v1/read) fails to validate the declared decoded length of a snappy-compressed request body before allocating heap memory. This flaw, linked to CWE-400 (Uncontrolled Resource Consumption) and CWE-789 (Memory Allocation with Excessive Size Value), carries a CVSS v3.1 base score of 7.5 (AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H).
An unauthenticated remote attacker can exploit this vulnerability by sending a small, specially crafted snappy-compressed payload to the /api/v1/read endpoint. The invalid declared decoded length triggers a disproportionately large heap allocation per request. Under concurrent requests, this leads to rapid memory exhaustion, causing the Prometheus process to crash and potentially disrupting monitoring services.
Prometheus has addressed this issue in versions 3.5.3 and 3.11.3, with patches detailed in GitHub pull requests #18584 and #18585, release notes for those tags, and security advisory GHSA-8rm2-7qqf-34qm. Security practitioners should upgrade affected Prometheus instances to these patched versions and consider network restrictions on the remote read endpoint if immediate patching is not feasible.
EU & UK References
- 🇪🇺 ENISA EUVD: EUVD-2026-27091
Vulnerability details
Prometheus is an open-source monitoring system and time series database. Prior to versions 3.5.3 and 3.11.3, the remote read endpoint (/api/v1/read) does not validate the declared decoded length in a snappy-compressed request body before allocating memory. An unauthenticated attacker can…
more
send a small payload that causes a huge heap allocation per request. Under concurrent load this can exhaust available memory and crash the Prometheus process. This issue has been patched in versions 3.5.3 and 3.11.3.
- CWE(s)
Related Threats
MITRE ATT&CK Enterprise TechniquesAI
Why these techniques?
Remote unauthenticated exploitation of memory allocation flaw in Prometheus /api/v1/read endpoint directly enables application/system exploitation leading to DoS via heap exhaustion and crash.
CVEs Like This One
Affected Assets
Mitigating Controls
Mitigating Controls (NIST 800-53 r5) AI
Directly remediates the memory allocation vulnerability by requiring timely application of vendor patches such as those in Prometheus versions 3.5.3 and 3.11.3.
Requires validation of information inputs like the declared decoded length in snappy-compressed requests to prevent excessive heap allocations from crafted payloads.
Protects against denial-of-service attacks by limiting the effects of concurrent requests causing memory exhaustion in the remote read endpoint.