VDB
Sign up
HIGH7.5

GHSA-8rm2-7qqf-34qm

Prometheus: Remote read endpoint allows denial of service via crafted snappy payload

Quick fix

GHSA-8rm2-7qqf-34qm — github.com/prometheus/prometheus: upgrade to the fixed version with the command below.

go get github.com/prometheus/prometheus@v0.311.3

Details

### Impact

The remote read endpoint (`/api/v1/read`) does not validate the declared decoded length in a snappy-compressed request body before allocating memory. An unauthenticated attacker can send a small payload that causes a huge heap allocation per request. Under concurrent load this can exhaust available memory and crash the Prometheus process.

### Patches _Has the problem been patched? What versions should users upgrade to?_

Fixed in 3.11.3 and 3.5.3 LTS. Users should upgrade to these versions or later.

### Workarounds User who can not upgrade can place Prometheus behind a reverse proxy or firewall that requires authentication before requests reach /api/v1/read.

Are you affected?

Enter the version of the package you're using.

Affected packages

Go/github.com/prometheus/prometheus
Introduced in: 0.306.0Fixed in: 0.311.3
Fixgo get github.com/prometheus/prometheus@v0.311.3
Go/github.com/prometheus/prometheus
Introduced in: 0Fixed in: 0.305.2
Fixgo get github.com/prometheus/prometheus@v0.305.2
Go/github.com/prometheus/prometheus
Introduced in: 1.0.0-rc.0

No fixed version published yet for github.com/prometheus/prometheus (go modules). Pin to a known-safe version or switch to an alternative.

References