SUSE-SU-2026:4606-1

Dashboard / Vulnerabilities / SUSE-SU-2026:4606-1

SUSE-SU-2026:4606-1

Summary: Security update for golang-github-prometheus-prometheus

Details: This update for golang-github-prometheus-prometheus fixes the following issues: golang-github-prometheus-prometheus was updated to version 3.13.2: - Security issues: * CVE-2026-39821: Fixed validation bypass and privilege escalation in Punycode label handling (bsc#1266608) * CVE-2026-56852: Fixed infinite loop on truncated or invalid UTF-8 input in unicode/norm handling (bsc#1272102) * CVE-2026-44990: Fixed stored XSS in the new React UI by sanitizing disallowed xmp elements (bsc#1275205) * CVE-2026-53606: Fixed incomplete URI scheme validation in sanitize-html that could enable XSS (bsc#1269966) * CVE-2026-2303: Fixed heap out-of-bounds read in GSSAPI error handling in mongo-driver (bsc#1269856) * CVE-2025-4673: Fixed credential leaks by stopping HTTP client header forwarding on redirects (bsc#1275206) * CVE-2023-45289: Fixed credential leaks by stopping header and cookie forwarding on HTTP redirects (bsc#1275207) * CVE-2025-61686: Fixed unauthorized file access and path traversal in react-router storage (bsc#1270711) * CVE-2026-40181: Fixed open redirect risks to external domains via relative paths in react-router (bsc#1267528) * CVE-2026-42342: Fixed DoS risks via unbounded path expansion in the manifest endpoint (bsc#1267538) * CVE-2026-42211: Fixed remote code execution risks from prototype pollution in react-router (bsc#1267534) * CVE-2026-39882: Fixed memory exhaustion via uncapped HTTP response reading in OpenTelemetry (bsc#1274221) * Fixed potential denial-of-service vulnerabilities by updating the gRPC dependency * Fixed memory exhaustion and DoS by rejecting snappy-compressed requests exceeding 32MB limit - Bug fixes and changes: * Fixed scrape manager failing to reload properly when SD configuration changes rapidly. * Prevent memory leak in remote-write path when the receiving endpoint is unavailable. * Native Histograms are no longer experimental. They are fully supported for production workloads. * Added support for OpenTelemetry traces within the Prometheus UI to correlate metrics and traces. * TSDB compaction speed optimized by improving the block merging algorithm. * Allow scraping of multiple targets using a single HTTP/2 connection to reduce overhead. * Added new metrics to monitor the health of the rule evaluation engine. * Incompatible: This affects scraping, remote read and write, alerting, and SD. Network paths might need adjustments to avoid redirects. * Incompatible: Rule group pagination tokens now use SHA-256 instead of MD5. Custom API consumers must adapt to the new longer token format. * Added 'group_limit' parameter to PromQL aggregations to restrict the number of results. * Incompatible: promtool relative paths in config files now resolve relative to the config directory itself, instead of the current working directory. * Support exporting TSDB blocks directly to cloud storage via the admin API. * Incompatible: Deprecated remote-write metrics like prometheus_remote_storage_samples_total are removed in favor of prometheus_wal_watcher_records_read_total. * Significant query performance boost for high-cardinality regex matchers. * Introduce a new UI interface for safely deleting specific time series data directly. * Added dynamic relabeling actions to extract substrings using regex capture groups. * Fixed UI displaying incorrect time ranges after a timezone change. * Bumped firewalld-prometheus-config to version 0.2 bumping OpenTelemetry to 1.43.0

References: https://www.suse.com/support/update/announcement/2026/suse-su-20264606-1/, https://bugzilla.suse.com/1266608, https://bugzilla.suse.com/1267528, https://bugzilla.suse.com/1267534, https://bugzilla.suse.com/1267538, https://bugzilla.suse.com/1269856, https://bugzilla.suse.com/1269966, https://bugzilla.suse.com/1270711, https://bugzilla.suse.com/1272102, https://bugzilla.suse.com/1274221, https://bugzilla.suse.com/1275205, https://bugzilla.suse.com/1275206, https://bugzilla.suse.com/1275207, https://www.suse.com/security/cve/CVE-2023-45289, https://www.suse.com/security/cve/CVE-2025-4673, https://www.suse.com/security/cve/CVE-2025-61686, https://www.suse.com/security/cve/CVE-2026-2303, https://www.suse.com/security/cve/CVE-2026-39821, https://www.suse.com/security/cve/CVE-2026-40181, https://www.suse.com/security/cve/CVE-2026-42211, https://www.suse.com/security/cve/CVE-2026-42342, https://www.suse.com/security/cve/CVE-2026-44990, https://www.suse.com/security/cve/CVE-2026-53606, https://www.suse.com/security/cve/CVE-2026-56852