parser

package

Go to main page

Versions in this module

v0

v0.313.1

Jul 10, 2026

v0.313.0

Jul 1, 2026

Changes in this version

+ const MAX_OF

+ const MIN_OF

+ var ErrUnexpected = errors.New("unexpected error")

v0.313.0-rc.1

Jun 22, 2026

v0.312.0

May 28, 2026

Changes in this version

+ func Keywords() []string

v0.312.0-rc.0

May 19, 2026

v0.311.3

Apr 27, 2026

v0.311.2

Apr 13, 2026 GO-2026-5264 +2 more

GO-2026-5264: Prometheus: Remote read endpoint allows denial of service via crafted snappy payload in github.com/prometheus/prometheus

GO-2026-5381: Prometheus vulnerable to stored XSS via crafted histogram bucket label values in the old web UI heatmap display in github.com/prometheus/prometheus

GO-2026-5710: Prometheus Azure AD remote write OAuth client secret exposed via config API in github.com/prometheus/prometheus

v0.311.1

Apr 7, 2026 GO-2026-5264 +3 more

GO-2026-5264: Prometheus: Remote read endpoint allows denial of service via crafted snappy payload in github.com/prometheus/prometheus

GO-2026-5381: Prometheus vulnerable to stored XSS via crafted histogram bucket label values in the old web UI heatmap display in github.com/prometheus/prometheus

GO-2026-5662: Prometheus has Stored XSS via metric names and label values in Prometheus web UI in github.com/prometheus/prometheus

GO-2026-5710: Prometheus Azure AD remote write OAuth client secret exposed via config API in github.com/prometheus/prometheus

v0.311.0

Apr 2, 2026 GO-2026-5264 +3 more

GO-2026-5264: Prometheus: Remote read endpoint allows denial of service via crafted snappy payload in github.com/prometheus/prometheus

GO-2026-5381: Prometheus vulnerable to stored XSS via crafted histogram bucket label values in the old web UI heatmap display in github.com/prometheus/prometheus

GO-2026-5662: Prometheus has Stored XSS via metric names and label values in Prometheus web UI in github.com/prometheus/prometheus

GO-2026-5710: Prometheus Azure AD remote write OAuth client secret exposed via config API in github.com/prometheus/prometheus

Changes in this version

+ const TRIM_LOWER

+ const TRIM_UPPER

+ type Options struct

+ EnableBinopFillModifiers bool

+ EnableExperimentalFunctions bool

+ EnableExtendedRangeSelectors bool

+ ExperimentalDurationExpr bool

type Parser

+ ParseMetric func(input string) (labels.Labels, error)

+ ParseMetricSelector func(input string) ([]*labels.Matcher, error)

+ ParseMetricSelectors func(matchers []string) ([][]*labels.Matcher, error)

+ ParseSeriesDesc func(input string) (labels.Labels, []SequenceValue, error)

+ RegisterFeatures func(r features.Collector)

v0.310.0

Feb 25, 2026 GO-2026-5264 +3 more

GO-2026-5264: Prometheus: Remote read endpoint allows denial of service via crafted snappy payload in github.com/prometheus/prometheus

GO-2026-5381: Prometheus vulnerable to stored XSS via crafted histogram bucket label values in the old web UI heatmap display in github.com/prometheus/prometheus

GO-2026-5662: Prometheus has Stored XSS via metric names and label values in Prometheus web UI in github.com/prometheus/prometheus

GO-2026-5710: Prometheus Azure AD remote write OAuth client secret exposed via config API in github.com/prometheus/prometheus

Changes in this version

+ const FILL

+ const FILL_LEFT

+ const FILL_RIGHT

+ const RANGE

+ var EnableBinopFillModifiers bool

type SequenceValue

+ CounterResetHintSet bool

+ type VectorMatchFillValues struct

+ LHS *float64

+ RHS *float64

type VectorMatching

+ FillValues VectorMatchFillValues

v0.310.0-rc.1

Feb 19, 2026 GO-2026-5264 +3 more

GO-2026-5264: Prometheus: Remote read endpoint allows denial of service via crafted snappy payload in github.com/prometheus/prometheus

GO-2026-5381: Prometheus vulnerable to stored XSS via crafted histogram bucket label values in the old web UI heatmap display in github.com/prometheus/prometheus

GO-2026-5662: Prometheus has Stored XSS via metric names and label values in Prometheus web UI in github.com/prometheus/prometheus

GO-2026-5710: Prometheus Azure AD remote write OAuth client secret exposed via config API in github.com/prometheus/prometheus

v0.310.0-rc.0

Feb 17, 2026 GO-2026-5264 +3 more

GO-2026-5264: Prometheus: Remote read endpoint allows denial of service via crafted snappy payload in github.com/prometheus/prometheus

GO-2026-5381: Prometheus vulnerable to stored XSS via crafted histogram bucket label values in the old web UI heatmap display in github.com/prometheus/prometheus

GO-2026-5662: Prometheus has Stored XSS via metric names and label values in Prometheus web UI in github.com/prometheus/prometheus

GO-2026-5710: Prometheus Azure AD remote write OAuth client secret exposed via config API in github.com/prometheus/prometheus

v0.309.1

Jan 7, 2026 GO-2026-5264 +3 more

GO-2026-5264: Prometheus: Remote read endpoint allows denial of service via crafted snappy payload in github.com/prometheus/prometheus

GO-2026-5381: Prometheus vulnerable to stored XSS via crafted histogram bucket label values in the old web UI heatmap display in github.com/prometheus/prometheus

GO-2026-5662: Prometheus has Stored XSS via metric names and label values in Prometheus web UI in github.com/prometheus/prometheus

GO-2026-5710: Prometheus Azure AD remote write OAuth client secret exposed via config API in github.com/prometheus/prometheus

v0.309.0

Jan 6, 2026 GO-2026-5264 +3 more

GO-2026-5264: Prometheus: Remote read endpoint allows denial of service via crafted snappy payload in github.com/prometheus/prometheus

GO-2026-5381: Prometheus vulnerable to stored XSS via crafted histogram bucket label values in the old web UI heatmap display in github.com/prometheus/prometheus

GO-2026-5662: Prometheus has Stored XSS via metric names and label values in Prometheus web UI in github.com/prometheus/prometheus

GO-2026-5710: Prometheus Azure AD remote write OAuth client secret exposed via config API in github.com/prometheus/prometheus

Changes in this version

+ func RegisterFeatures(r features.Collector)

v0.308.1

Dec 16, 2025 GO-2026-5264 +3 more

GO-2026-5264: Prometheus: Remote read endpoint allows denial of service via crafted snappy payload in github.com/prometheus/prometheus

GO-2026-5381: Prometheus vulnerable to stored XSS via crafted histogram bucket label values in the old web UI heatmap display in github.com/prometheus/prometheus

GO-2026-5662: Prometheus has Stored XSS via metric names and label values in Prometheus web UI in github.com/prometheus/prometheus

GO-2026-5710: Prometheus Azure AD remote write OAuth client secret exposed via config API in github.com/prometheus/prometheus

v0.308.0

Dec 2, 2025 GO-2026-5264 +3 more

GO-2026-5264: Prometheus: Remote read endpoint allows denial of service via crafted snappy payload in github.com/prometheus/prometheus

GO-2026-5381: Prometheus vulnerable to stored XSS via crafted histogram bucket label values in the old web UI heatmap display in github.com/prometheus/prometheus

GO-2026-5662: Prometheus has Stored XSS via metric names and label values in Prometheus web UI in github.com/prometheus/prometheus

GO-2026-5710: Prometheus Azure AD remote write OAuth client secret exposed via config API in github.com/prometheus/prometheus

v0.308.0-rc.1

Nov 24, 2025 GO-2026-5264 +3 more

GO-2026-5264: Prometheus: Remote read endpoint allows denial of service via crafted snappy payload in github.com/prometheus/prometheus

GO-2026-5381: Prometheus vulnerable to stored XSS via crafted histogram bucket label values in the old web UI heatmap display in github.com/prometheus/prometheus

GO-2026-5662: Prometheus has Stored XSS via metric names and label values in Prometheus web UI in github.com/prometheus/prometheus

GO-2026-5710: Prometheus Azure AD remote write OAuth client secret exposed via config API in github.com/prometheus/prometheus

v0.308.0-rc.0

Nov 14, 2025 GO-2026-5264 +3 more

GO-2026-5264: Prometheus: Remote read endpoint allows denial of service via crafted snappy payload in github.com/prometheus/prometheus

GO-2026-5381: Prometheus vulnerable to stored XSS via crafted histogram bucket label values in the old web UI heatmap display in github.com/prometheus/prometheus

GO-2026-5662: Prometheus has Stored XSS via metric names and label values in Prometheus web UI in github.com/prometheus/prometheus

GO-2026-5710: Prometheus Azure AD remote write OAuth client secret exposed via config API in github.com/prometheus/prometheus

v0.307.3

Oct 30, 2025 GO-2026-5264 +3 more

GO-2026-5264: Prometheus: Remote read endpoint allows denial of service via crafted snappy payload in github.com/prometheus/prometheus

GO-2026-5381: Prometheus vulnerable to stored XSS via crafted histogram bucket label values in the old web UI heatmap display in github.com/prometheus/prometheus

GO-2026-5662: Prometheus has Stored XSS via metric names and label values in Prometheus web UI in github.com/prometheus/prometheus

GO-2026-5710: Prometheus Azure AD remote write OAuth client secret exposed via config API in github.com/prometheus/prometheus

v0.307.2

Oct 22, 2025 GO-2026-5264 +3 more

GO-2026-5264: Prometheus: Remote read endpoint allows denial of service via crafted snappy payload in github.com/prometheus/prometheus

GO-2026-5381: Prometheus vulnerable to stored XSS via crafted histogram bucket label values in the old web UI heatmap display in github.com/prometheus/prometheus

GO-2026-5662: Prometheus has Stored XSS via metric names and label values in Prometheus web UI in github.com/prometheus/prometheus

GO-2026-5710: Prometheus Azure AD remote write OAuth client secret exposed via config API in github.com/prometheus/prometheus

v0.307.1

Oct 17, 2025 GO-2026-5264 +3 more

GO-2026-5264: Prometheus: Remote read endpoint allows denial of service via crafted snappy payload in github.com/prometheus/prometheus

GO-2026-5381: Prometheus vulnerable to stored XSS via crafted histogram bucket label values in the old web UI heatmap display in github.com/prometheus/prometheus

GO-2026-5662: Prometheus has Stored XSS via metric names and label values in Prometheus web UI in github.com/prometheus/prometheus

GO-2026-5710: Prometheus Azure AD remote write OAuth client secret exposed via config API in github.com/prometheus/prometheus

v0.307.0

Oct 15, 2025 GO-2026-5264 +3 more

GO-2026-5264: Prometheus: Remote read endpoint allows denial of service via crafted snappy payload in github.com/prometheus/prometheus

GO-2026-5381: Prometheus vulnerable to stored XSS via crafted histogram bucket label values in the old web UI heatmap display in github.com/prometheus/prometheus

GO-2026-5662: Prometheus has Stored XSS via metric names and label values in Prometheus web UI in github.com/prometheus/prometheus

GO-2026-5710: Prometheus Azure AD remote write OAuth client secret exposed via config API in github.com/prometheus/prometheus

Changes in this version

+ const ANCHORED

+ const SMOOTHED

+ var EnableExtendedRangeSelectors bool

+ func ChildrenIter(node Node) func(func(Node) bool)

type VectorSelector

+ Anchored bool

+ Smoothed bool

v0.307.0-rc.0

Oct 8, 2025 GO-2026-5264 +3 more

GO-2026-5264: Prometheus: Remote read endpoint allows denial of service via crafted snappy payload in github.com/prometheus/prometheus

GO-2026-5381: Prometheus vulnerable to stored XSS via crafted histogram bucket label values in the old web UI heatmap display in github.com/prometheus/prometheus

GO-2026-5662: Prometheus has Stored XSS via metric names and label values in Prometheus web UI in github.com/prometheus/prometheus

GO-2026-5710: Prometheus Azure AD remote write OAuth client secret exposed via config API in github.com/prometheus/prometheus

v0.306.0

Sep 17, 2025 GO-2026-5264 +3 more

GO-2026-5264: Prometheus: Remote read endpoint allows denial of service via crafted snappy payload in github.com/prometheus/prometheus

GO-2026-5381: Prometheus vulnerable to stored XSS via crafted histogram bucket label values in the old web UI heatmap display in github.com/prometheus/prometheus

GO-2026-5662: Prometheus has Stored XSS via metric names and label values in Prometheus web UI in github.com/prometheus/prometheus

GO-2026-5710: Prometheus Azure AD remote write OAuth client secret exposed via config API in github.com/prometheus/prometheus

Changes in this version

+ const STEP

type DurationExpr

+ EndPos posrange.Pos

v0.306.0-rc.1

Sep 10, 2025 GO-2026-5381 +2 more

GO-2026-5381: Prometheus vulnerable to stored XSS via crafted histogram bucket label values in the old web UI heatmap display in github.com/prometheus/prometheus

GO-2026-5662: Prometheus has Stored XSS via metric names and label values in Prometheus web UI in github.com/prometheus/prometheus

GO-2026-5710: Prometheus Azure AD remote write OAuth client secret exposed via config API in github.com/prometheus/prometheus

v0.306.0-rc.0

Aug 21, 2025 GO-2026-5381 +2 more

GO-2026-5381: Prometheus vulnerable to stored XSS via crafted histogram bucket label values in the old web UI heatmap display in github.com/prometheus/prometheus

GO-2026-5662: Prometheus has Stored XSS via metric names and label values in Prometheus web UI in github.com/prometheus/prometheus

GO-2026-5710: Prometheus Azure AD remote write OAuth client secret exposed via config API in github.com/prometheus/prometheus

v0.305.5

Jul 8, 2026 GO-2026-5381 +2 more

GO-2026-5381: Prometheus vulnerable to stored XSS via crafted histogram bucket label values in the old web UI heatmap display in github.com/prometheus/prometheus

GO-2026-5662: Prometheus has Stored XSS via metric names and label values in Prometheus web UI in github.com/prometheus/prometheus

GO-2026-5710: Prometheus Azure AD remote write OAuth client secret exposed via config API in github.com/prometheus/prometheus

v0.305.4

Jun 17, 2026 GO-2026-5381 +2 more

GO-2026-5381: Prometheus vulnerable to stored XSS via crafted histogram bucket label values in the old web UI heatmap display in github.com/prometheus/prometheus

GO-2026-5662: Prometheus has Stored XSS via metric names and label values in Prometheus web UI in github.com/prometheus/prometheus

GO-2026-5710: Prometheus Azure AD remote write OAuth client secret exposed via config API in github.com/prometheus/prometheus

v0.305.3

Apr 27, 2026 GO-2026-5381 +2 more

GO-2026-5381: Prometheus vulnerable to stored XSS via crafted histogram bucket label values in the old web UI heatmap display in github.com/prometheus/prometheus

GO-2026-5662: Prometheus has Stored XSS via metric names and label values in Prometheus web UI in github.com/prometheus/prometheus

GO-2026-5710: Prometheus Azure AD remote write OAuth client secret exposed via config API in github.com/prometheus/prometheus

v0.305.2

Apr 13, 2026 GO-2026-5381 +2 more

GO-2026-5381: Prometheus vulnerable to stored XSS via crafted histogram bucket label values in the old web UI heatmap display in github.com/prometheus/prometheus

GO-2026-5662: Prometheus has Stored XSS via metric names and label values in Prometheus web UI in github.com/prometheus/prometheus

GO-2026-5710: Prometheus Azure AD remote write OAuth client secret exposed via config API in github.com/prometheus/prometheus

v0.305.1

Jan 21, 2026 GO-2026-5264 +3 more

GO-2026-5264: Prometheus: Remote read endpoint allows denial of service via crafted snappy payload in github.com/prometheus/prometheus

GO-2026-5381: Prometheus vulnerable to stored XSS via crafted histogram bucket label values in the old web UI heatmap display in github.com/prometheus/prometheus

GO-2026-5662: Prometheus has Stored XSS via metric names and label values in Prometheus web UI in github.com/prometheus/prometheus

GO-2026-5710: Prometheus Azure AD remote write OAuth client secret exposed via config API in github.com/prometheus/prometheus

v0.305.0

Jul 14, 2025 GO-2026-5264 +3 more

GO-2026-5264: Prometheus: Remote read endpoint allows denial of service via crafted snappy payload in github.com/prometheus/prometheus

GO-2026-5381: Prometheus vulnerable to stored XSS via crafted histogram bucket label values in the old web UI heatmap display in github.com/prometheus/prometheus

GO-2026-5662: Prometheus has Stored XSS via metric names and label values in Prometheus web UI in github.com/prometheus/prometheus

GO-2026-5710: Prometheus Azure AD remote write OAuth client secret exposed via config API in github.com/prometheus/prometheus

v0.304.2

Jun 26, 2025 GO-2026-5264 +3 more

GO-2026-5264: Prometheus: Remote read endpoint allows denial of service via crafted snappy payload in github.com/prometheus/prometheus

GO-2026-5381: Prometheus vulnerable to stored XSS via crafted histogram bucket label values in the old web UI heatmap display in github.com/prometheus/prometheus

GO-2026-5662: Prometheus has Stored XSS via metric names and label values in Prometheus web UI in github.com/prometheus/prometheus

GO-2026-5710: Prometheus Azure AD remote write OAuth client secret exposed via config API in github.com/prometheus/prometheus

v0.304.1

May 31, 2025 GO-2026-5264 +3 more

GO-2026-5264: Prometheus: Remote read endpoint allows denial of service via crafted snappy payload in github.com/prometheus/prometheus

GO-2026-5381: Prometheus vulnerable to stored XSS via crafted histogram bucket label values in the old web UI heatmap display in github.com/prometheus/prometheus

GO-2026-5662: Prometheus has Stored XSS via metric names and label values in Prometheus web UI in github.com/prometheus/prometheus

GO-2026-5710: Prometheus Azure AD remote write OAuth client secret exposed via config API in github.com/prometheus/prometheus

v0.304.0

May 17, 2025 GO-2026-5264 +3 more

GO-2026-5264: Prometheus: Remote read endpoint allows denial of service via crafted snappy payload in github.com/prometheus/prometheus

GO-2026-5381: Prometheus vulnerable to stored XSS via crafted histogram bucket label values in the old web UI heatmap display in github.com/prometheus/prometheus

GO-2026-5662: Prometheus has Stored XSS via metric names and label values in Prometheus web UI in github.com/prometheus/prometheus

GO-2026-5710: Prometheus Azure AD remote write OAuth client secret exposed via config API in github.com/prometheus/prometheus

Changes in this version

+ var ExperimentalDurationExpr bool

+ type DurationExpr struct

+ LHS Expr

+ Op ItemType

+ RHS Expr

+ StartPos posrange.Pos

+ Wrapped bool

+ func (*DurationExpr) PromQLExpr()

+ func (e *DurationExpr) PositionRange() posrange.PositionRange

+ func (e *DurationExpr) Pretty(int) string

+ func (e *DurationExpr) Type() ValueType

+ func (node *DurationExpr) ShortString() string

+ func (node *DurationExpr) String() string

type MatrixSelector

+ RangeExpr *DurationExpr

type NumberLiteral

+ Duration bool

type SubqueryExpr

+ OriginalOffsetExpr *DurationExpr

+ RangeExpr *DurationExpr

+ StepExpr *DurationExpr

type VectorSelector

+ OriginalOffsetExpr *DurationExpr

v0.304.0-rc.0

May 2, 2025 GO-2026-5264 +3 more

GO-2026-5264: Prometheus: Remote read endpoint allows denial of service via crafted snappy payload in github.com/prometheus/prometheus

GO-2026-5381: Prometheus vulnerable to stored XSS via crafted histogram bucket label values in the old web UI heatmap display in github.com/prometheus/prometheus

GO-2026-5662: Prometheus has Stored XSS via metric names and label values in Prometheus web UI in github.com/prometheus/prometheus

GO-2026-5710: Prometheus Azure AD remote write OAuth client secret exposed via config API in github.com/prometheus/prometheus

v0.303.1

May 2, 2025 GO-2026-5264 +3 more

GO-2026-5264: Prometheus: Remote read endpoint allows denial of service via crafted snappy payload in github.com/prometheus/prometheus

GO-2026-5381: Prometheus vulnerable to stored XSS via crafted histogram bucket label values in the old web UI heatmap display in github.com/prometheus/prometheus

GO-2026-5662: Prometheus has Stored XSS via metric names and label values in Prometheus web UI in github.com/prometheus/prometheus

GO-2026-5710: Prometheus Azure AD remote write OAuth client secret exposed via config API in github.com/prometheus/prometheus

v0.303.0

Apr 15, 2025 GO-2026-5264 +3 more

GO-2026-5264: Prometheus: Remote read endpoint allows denial of service via crafted snappy payload in github.com/prometheus/prometheus

GO-2026-5381: Prometheus vulnerable to stored XSS via crafted histogram bucket label values in the old web UI heatmap display in github.com/prometheus/prometheus

GO-2026-5662: Prometheus has Stored XSS via metric names and label values in Prometheus web UI in github.com/prometheus/prometheus

GO-2026-5710: Prometheus Azure AD remote write OAuth client secret exposed via config API in github.com/prometheus/prometheus

v0.303.0-rc.1

Apr 3, 2025 GO-2026-5264 +3 more

GO-2026-5264: Prometheus: Remote read endpoint allows denial of service via crafted snappy payload in github.com/prometheus/prometheus

GO-2026-5381: Prometheus vulnerable to stored XSS via crafted histogram bucket label values in the old web UI heatmap display in github.com/prometheus/prometheus

GO-2026-5662: Prometheus has Stored XSS via metric names and label values in Prometheus web UI in github.com/prometheus/prometheus

GO-2026-5710: Prometheus Azure AD remote write OAuth client secret exposed via config API in github.com/prometheus/prometheus

v0.303.0-rc.0

Mar 26, 2025 GO-2026-5264 +3 more

GO-2026-5264: Prometheus: Remote read endpoint allows denial of service via crafted snappy payload in github.com/prometheus/prometheus

GO-2026-5381: Prometheus vulnerable to stored XSS via crafted histogram bucket label values in the old web UI heatmap display in github.com/prometheus/prometheus

GO-2026-5662: Prometheus has Stored XSS via metric names and label values in Prometheus web UI in github.com/prometheus/prometheus

GO-2026-5710: Prometheus Azure AD remote write OAuth client secret exposed via config API in github.com/prometheus/prometheus

v0.302.1

Feb 25, 2025 GO-2026-5264 +3 more

GO-2026-5264: Prometheus: Remote read endpoint allows denial of service via crafted snappy payload in github.com/prometheus/prometheus

GO-2026-5381: Prometheus vulnerable to stored XSS via crafted histogram bucket label values in the old web UI heatmap display in github.com/prometheus/prometheus

GO-2026-5662: Prometheus has Stored XSS via metric names and label values in Prometheus web UI in github.com/prometheus/prometheus

GO-2026-5710: Prometheus Azure AD remote write OAuth client secret exposed via config API in github.com/prometheus/prometheus

v0.302.0

Feb 17, 2025 GO-2026-5264 +3 more

GO-2026-5264: Prometheus: Remote read endpoint allows denial of service via crafted snappy payload in github.com/prometheus/prometheus

GO-2026-5381: Prometheus vulnerable to stored XSS via crafted histogram bucket label values in the old web UI heatmap display in github.com/prometheus/prometheus

GO-2026-5662: Prometheus has Stored XSS via metric names and label values in Prometheus web UI in github.com/prometheus/prometheus

GO-2026-5710: Prometheus Azure AD remote write OAuth client secret exposed via config API in github.com/prometheus/prometheus

v0.302.0-rc.1

Feb 4, 2025 GO-2026-5264 +3 more

GO-2026-5264: Prometheus: Remote read endpoint allows denial of service via crafted snappy payload in github.com/prometheus/prometheus

GO-2026-5381: Prometheus vulnerable to stored XSS via crafted histogram bucket label values in the old web UI heatmap display in github.com/prometheus/prometheus

GO-2026-5662: Prometheus has Stored XSS via metric names and label values in Prometheus web UI in github.com/prometheus/prometheus

GO-2026-5710: Prometheus Azure AD remote write OAuth client secret exposed via config API in github.com/prometheus/prometheus

v0.302.0-rc.0

Feb 4, 2025 GO-2026-5264 +3 more

GO-2026-5264: Prometheus: Remote read endpoint allows denial of service via crafted snappy payload in github.com/prometheus/prometheus

GO-2026-5381: Prometheus vulnerable to stored XSS via crafted histogram bucket label values in the old web UI heatmap display in github.com/prometheus/prometheus

GO-2026-5662: Prometheus has Stored XSS via metric names and label values in Prometheus web UI in github.com/prometheus/prometheus

GO-2026-5710: Prometheus Azure AD remote write OAuth client secret exposed via config API in github.com/prometheus/prometheus

v0.301.0

Jan 2, 2025 GO-2026-5264 +3 more

GO-2026-5264: Prometheus: Remote read endpoint allows denial of service via crafted snappy payload in github.com/prometheus/prometheus

GO-2026-5381: Prometheus vulnerable to stored XSS via crafted histogram bucket label values in the old web UI heatmap display in github.com/prometheus/prometheus

GO-2026-5662: Prometheus has Stored XSS via metric names and label values in Prometheus web UI in github.com/prometheus/prometheus

GO-2026-5710: Prometheus Azure AD remote write OAuth client secret exposed via config API in github.com/prometheus/prometheus

Changes in this version

type ItemType

+ func (i ItemType) IsExperimentalAggregator() bool

v0.301.0-rc.1

Dec 30, 2024 GO-2026-5264 +3 more

GO-2026-5264: Prometheus: Remote read endpoint allows denial of service via crafted snappy payload in github.com/prometheus/prometheus

GO-2026-5381: Prometheus vulnerable to stored XSS via crafted histogram bucket label values in the old web UI heatmap display in github.com/prometheus/prometheus

GO-2026-5662: Prometheus has Stored XSS via metric names and label values in Prometheus web UI in github.com/prometheus/prometheus

GO-2026-5710: Prometheus Azure AD remote write OAuth client secret exposed via config API in github.com/prometheus/prometheus

v0.301.0-rc.0

Dec 20, 2024 GO-2026-5264 +3 more

GO-2026-5264: Prometheus: Remote read endpoint allows denial of service via crafted snappy payload in github.com/prometheus/prometheus

GO-2026-5381: Prometheus vulnerable to stored XSS via crafted histogram bucket label values in the old web UI heatmap display in github.com/prometheus/prometheus

GO-2026-5662: Prometheus has Stored XSS via metric names and label values in Prometheus web UI in github.com/prometheus/prometheus

GO-2026-5710: Prometheus Azure AD remote write OAuth client secret exposed via config API in github.com/prometheus/prometheus

v0.300.1

Nov 28, 2024 GO-2026-5264 +3 more

GO-2026-5264: Prometheus: Remote read endpoint allows denial of service via crafted snappy payload in github.com/prometheus/prometheus

GO-2026-5381: Prometheus vulnerable to stored XSS via crafted histogram bucket label values in the old web UI heatmap display in github.com/prometheus/prometheus

GO-2026-5662: Prometheus has Stored XSS via metric names and label values in Prometheus web UI in github.com/prometheus/prometheus

GO-2026-5710: Prometheus Azure AD remote write OAuth client secret exposed via config API in github.com/prometheus/prometheus

v0.300.0

Nov 14, 2024 GO-2026-5264 +3 more

GO-2026-5264: Prometheus: Remote read endpoint allows denial of service via crafted snappy payload in github.com/prometheus/prometheus

GO-2026-5381: Prometheus vulnerable to stored XSS via crafted histogram bucket label values in the old web UI heatmap display in github.com/prometheus/prometheus

GO-2026-5662: Prometheus has Stored XSS via metric names and label values in Prometheus web UI in github.com/prometheus/prometheus

GO-2026-5710: Prometheus Azure AD remote write OAuth client secret exposed via config API in github.com/prometheus/prometheus

v0.300.0-rc.1

Nov 11, 2024 GO-2026-5264 +3 more

GO-2026-5264: Prometheus: Remote read endpoint allows denial of service via crafted snappy payload in github.com/prometheus/prometheus

GO-2026-5381: Prometheus vulnerable to stored XSS via crafted histogram bucket label values in the old web UI heatmap display in github.com/prometheus/prometheus

GO-2026-5662: Prometheus has Stored XSS via metric names and label values in Prometheus web UI in github.com/prometheus/prometheus

GO-2026-5710: Prometheus Azure AD remote write OAuth client secret exposed via config API in github.com/prometheus/prometheus

v0.300.0-rc.0

Oct 31, 2024 GO-2026-5264 +3 more

GO-2026-5264: Prometheus: Remote read endpoint allows denial of service via crafted snappy payload in github.com/prometheus/prometheus

GO-2026-5381: Prometheus vulnerable to stored XSS via crafted histogram bucket label values in the old web UI heatmap display in github.com/prometheus/prometheus

GO-2026-5662: Prometheus has Stored XSS via metric names and label values in Prometheus web UI in github.com/prometheus/prometheus

GO-2026-5710: Prometheus Azure AD remote write OAuth client secret exposed via config API in github.com/prometheus/prometheus

v0.300.0-beta.1

Oct 14, 2024 GO-2026-5264 +3 more

GO-2026-5264: Prometheus: Remote read endpoint allows denial of service via crafted snappy payload in github.com/prometheus/prometheus

GO-2026-5381: Prometheus vulnerable to stored XSS via crafted histogram bucket label values in the old web UI heatmap display in github.com/prometheus/prometheus

GO-2026-5662: Prometheus has Stored XSS via metric names and label values in Prometheus web UI in github.com/prometheus/prometheus

GO-2026-5710: Prometheus Azure AD remote write OAuth client secret exposed via config API in github.com/prometheus/prometheus

v0.300.0-beta.0

Sep 10, 2024 GO-2026-5264 +3 more

GO-2026-5264: Prometheus: Remote read endpoint allows denial of service via crafted snappy payload in github.com/prometheus/prometheus

GO-2026-5381: Prometheus vulnerable to stored XSS via crafted histogram bucket label values in the old web UI heatmap display in github.com/prometheus/prometheus

GO-2026-5662: Prometheus has Stored XSS via metric names and label values in Prometheus web UI in github.com/prometheus/prometheus

GO-2026-5710: Prometheus Azure AD remote write OAuth client secret exposed via config API in github.com/prometheus/prometheus

v0.55.1

Nov 4, 2024 GO-2026-5264 +3 more

GO-2026-5264: Prometheus: Remote read endpoint allows denial of service via crafted snappy payload in github.com/prometheus/prometheus

GO-2026-5381: Prometheus vulnerable to stored XSS via crafted histogram bucket label values in the old web UI heatmap display in github.com/prometheus/prometheus

GO-2026-5662: Prometheus has Stored XSS via metric names and label values in Prometheus web UI in github.com/prometheus/prometheus

GO-2026-5710: Prometheus Azure AD remote write OAuth client secret exposed via config API in github.com/prometheus/prometheus

v0.55.0

Oct 22, 2024 GO-2026-5264 +3 more

GO-2026-5264: Prometheus: Remote read endpoint allows denial of service via crafted snappy payload in github.com/prometheus/prometheus

GO-2026-5381: Prometheus vulnerable to stored XSS via crafted histogram bucket label values in the old web UI heatmap display in github.com/prometheus/prometheus

GO-2026-5662: Prometheus has Stored XSS via metric names and label values in Prometheus web UI in github.com/prometheus/prometheus

GO-2026-5710: Prometheus Azure AD remote write OAuth client secret exposed via config API in github.com/prometheus/prometheus

Changes in this version

+ const COUNTER_RESET

+ const COUNTER_RESET_HINT_DESC

+ const GAUGE_TYPE

+ const NOT_COUNTER_RESET

+ const UNKNOWN_COUNTER_RESET

type AggregateExpr

+ func (node *AggregateExpr) ShortString() string

type BinaryExpr

+ func (node *BinaryExpr) ShortString() string

type Call

+ func (node *Call) ShortString() string

type MatrixSelector

+ func (node *MatrixSelector) ShortString() string

type SubqueryExpr

+ func (node *SubqueryExpr) ShortString() string

type UnaryExpr

+ func (node *UnaryExpr) ShortString() string

type VectorSelector

+ BypassEmptyMatcherCheck bool

v0.54.1

Aug 27, 2024 GO-2026-5264 +3 more

GO-2026-5264: Prometheus: Remote read endpoint allows denial of service via crafted snappy payload in github.com/prometheus/prometheus

GO-2026-5381: Prometheus vulnerable to stored XSS via crafted histogram bucket label values in the old web UI heatmap display in github.com/prometheus/prometheus

GO-2026-5662: Prometheus has Stored XSS via metric names and label values in Prometheus web UI in github.com/prometheus/prometheus

GO-2026-5710: Prometheus Azure AD remote write OAuth client secret exposed via config API in github.com/prometheus/prometheus

v0.54.0

Aug 9, 2024 GO-2026-5264 +3 more

GO-2026-5264: Prometheus: Remote read endpoint allows denial of service via crafted snappy payload in github.com/prometheus/prometheus

GO-2026-5381: Prometheus vulnerable to stored XSS via crafted histogram bucket label values in the old web UI heatmap display in github.com/prometheus/prometheus

GO-2026-5662: Prometheus has Stored XSS via metric names and label values in Prometheus web UI in github.com/prometheus/prometheus

GO-2026-5710: Prometheus Azure AD remote write OAuth client secret exposed via config API in github.com/prometheus/prometheus

Changes in this version

+ const CUSTOM_VALUES_DESC

+ const LIMITK

+ const LIMIT_RATIO

type VectorSelector

+ SkipHistogramBuckets bool

v0.54.0-rc.0

Jul 30, 2024 GO-2026-5264 +3 more

GO-2026-5264: Prometheus: Remote read endpoint allows denial of service via crafted snappy payload in github.com/prometheus/prometheus

GO-2026-5381: Prometheus vulnerable to stored XSS via crafted histogram bucket label values in the old web UI heatmap display in github.com/prometheus/prometheus

GO-2026-5662: Prometheus has Stored XSS via metric names and label values in Prometheus web UI in github.com/prometheus/prometheus

GO-2026-5710: Prometheus Azure AD remote write OAuth client secret exposed via config API in github.com/prometheus/prometheus

v0.53.4

Mar 18, 2025 GO-2026-5264 +3 more

GO-2026-5264: Prometheus: Remote read endpoint allows denial of service via crafted snappy payload in github.com/prometheus/prometheus

GO-2026-5381: Prometheus vulnerable to stored XSS via crafted histogram bucket label values in the old web UI heatmap display in github.com/prometheus/prometheus

GO-2026-5662: Prometheus has Stored XSS via metric names and label values in Prometheus web UI in github.com/prometheus/prometheus

GO-2026-5710: Prometheus Azure AD remote write OAuth client secret exposed via config API in github.com/prometheus/prometheus

v0.53.3

Nov 5, 2024 GO-2026-5264 +3 more

GO-2026-5264: Prometheus: Remote read endpoint allows denial of service via crafted snappy payload in github.com/prometheus/prometheus

GO-2026-5381: Prometheus vulnerable to stored XSS via crafted histogram bucket label values in the old web UI heatmap display in github.com/prometheus/prometheus

GO-2026-5662: Prometheus has Stored XSS via metric names and label values in Prometheus web UI in github.com/prometheus/prometheus

GO-2026-5710: Prometheus Azure AD remote write OAuth client secret exposed via config API in github.com/prometheus/prometheus

v0.53.2

Aug 9, 2024 GO-2026-5264 +3 more

GO-2026-5264: Prometheus: Remote read endpoint allows denial of service via crafted snappy payload in github.com/prometheus/prometheus

GO-2026-5381: Prometheus vulnerable to stored XSS via crafted histogram bucket label values in the old web UI heatmap display in github.com/prometheus/prometheus

GO-2026-5662: Prometheus has Stored XSS via metric names and label values in Prometheus web UI in github.com/prometheus/prometheus

GO-2026-5710: Prometheus Azure AD remote write OAuth client secret exposed via config API in github.com/prometheus/prometheus

v0.53.1

Jul 10, 2024 GO-2026-5264 +3 more

GO-2026-5264: Prometheus: Remote read endpoint allows denial of service via crafted snappy payload in github.com/prometheus/prometheus

GO-2026-5381: Prometheus vulnerable to stored XSS via crafted histogram bucket label values in the old web UI heatmap display in github.com/prometheus/prometheus

GO-2026-5662: Prometheus has Stored XSS via metric names and label values in Prometheus web UI in github.com/prometheus/prometheus

GO-2026-5710: Prometheus Azure AD remote write OAuth client secret exposed via config API in github.com/prometheus/prometheus

v0.53.0

Jun 18, 2024 GO-2026-5264 +3 more

GO-2026-5264: Prometheus: Remote read endpoint allows denial of service via crafted snappy payload in github.com/prometheus/prometheus

GO-2026-5381: Prometheus vulnerable to stored XSS via crafted histogram bucket label values in the old web UI heatmap display in github.com/prometheus/prometheus

GO-2026-5662: Prometheus has Stored XSS via metric names and label values in Prometheus web UI in github.com/prometheus/prometheus

GO-2026-5710: Prometheus Azure AD remote write OAuth client secret exposed via config API in github.com/prometheus/prometheus

v0.53.0-rc.1

Jun 11, 2024 GO-2026-5264 +3 more

GO-2026-5264: Prometheus: Remote read endpoint allows denial of service via crafted snappy payload in github.com/prometheus/prometheus

GO-2026-5381: Prometheus vulnerable to stored XSS via crafted histogram bucket label values in the old web UI heatmap display in github.com/prometheus/prometheus

GO-2026-5662: Prometheus has Stored XSS via metric names and label values in Prometheus web UI in github.com/prometheus/prometheus

GO-2026-5710: Prometheus Azure AD remote write OAuth client secret exposed via config API in github.com/prometheus/prometheus

v0.53.0-rc.0

Jun 7, 2024 GO-2026-5264 +3 more

GO-2026-5264: Prometheus: Remote read endpoint allows denial of service via crafted snappy payload in github.com/prometheus/prometheus

GO-2026-5381: Prometheus vulnerable to stored XSS via crafted histogram bucket label values in the old web UI heatmap display in github.com/prometheus/prometheus

GO-2026-5662: Prometheus has Stored XSS via metric names and label values in Prometheus web UI in github.com/prometheus/prometheus

GO-2026-5710: Prometheus Azure AD remote write OAuth client secret exposed via config API in github.com/prometheus/prometheus

v0.52.1

May 30, 2024 GO-2026-5264 +3 more

GO-2026-5264: Prometheus: Remote read endpoint allows denial of service via crafted snappy payload in github.com/prometheus/prometheus

GO-2026-5381: Prometheus vulnerable to stored XSS via crafted histogram bucket label values in the old web UI heatmap display in github.com/prometheus/prometheus

GO-2026-5662: Prometheus has Stored XSS via metric names and label values in Prometheus web UI in github.com/prometheus/prometheus

GO-2026-5710: Prometheus Azure AD remote write OAuth client secret exposed via config API in github.com/prometheus/prometheus

v0.52.0

May 8, 2024 GO-2026-5264 +3 more

GO-2026-5264: Prometheus: Remote read endpoint allows denial of service via crafted snappy payload in github.com/prometheus/prometheus

GO-2026-5381: Prometheus vulnerable to stored XSS via crafted histogram bucket label values in the old web UI heatmap display in github.com/prometheus/prometheus

GO-2026-5662: Prometheus has Stored XSS via metric names and label values in Prometheus web UI in github.com/prometheus/prometheus

GO-2026-5710: Prometheus Azure AD remote write OAuth client secret exposed via config API in github.com/prometheus/prometheus

v0.52.0-rc.1

May 3, 2024 GO-2026-5264 +3 more

GO-2026-5264: Prometheus: Remote read endpoint allows denial of service via crafted snappy payload in github.com/prometheus/prometheus

GO-2026-5381: Prometheus vulnerable to stored XSS via crafted histogram bucket label values in the old web UI heatmap display in github.com/prometheus/prometheus

GO-2026-5662: Prometheus has Stored XSS via metric names and label values in Prometheus web UI in github.com/prometheus/prometheus

GO-2026-5710: Prometheus Azure AD remote write OAuth client secret exposed via config API in github.com/prometheus/prometheus

v0.52.0-rc.0

Apr 30, 2024 GO-2026-5264 +3 more

GO-2026-5264: Prometheus: Remote read endpoint allows denial of service via crafted snappy payload in github.com/prometheus/prometheus

GO-2026-5381: Prometheus vulnerable to stored XSS via crafted histogram bucket label values in the old web UI heatmap display in github.com/prometheus/prometheus

GO-2026-5662: Prometheus has Stored XSS via metric names and label values in Prometheus web UI in github.com/prometheus/prometheus

GO-2026-5710: Prometheus Azure AD remote write OAuth client secret exposed via config API in github.com/prometheus/prometheus

v0.51.2

Apr 10, 2024 GO-2026-5264 +3 more

GO-2026-5264: Prometheus: Remote read endpoint allows denial of service via crafted snappy payload in github.com/prometheus/prometheus

GO-2026-5381: Prometheus vulnerable to stored XSS via crafted histogram bucket label values in the old web UI heatmap display in github.com/prometheus/prometheus

GO-2026-5662: Prometheus has Stored XSS via metric names and label values in Prometheus web UI in github.com/prometheus/prometheus

GO-2026-5710: Prometheus Azure AD remote write OAuth client secret exposed via config API in github.com/prometheus/prometheus

v0.51.1

Mar 28, 2024 GO-2026-5264 +3 more

GO-2026-5264: Prometheus: Remote read endpoint allows denial of service via crafted snappy payload in github.com/prometheus/prometheus

GO-2026-5381: Prometheus vulnerable to stored XSS via crafted histogram bucket label values in the old web UI heatmap display in github.com/prometheus/prometheus

GO-2026-5662: Prometheus has Stored XSS via metric names and label values in Prometheus web UI in github.com/prometheus/prometheus

GO-2026-5710: Prometheus Azure AD remote write OAuth client secret exposed via config API in github.com/prometheus/prometheus

v0.51.0

Mar 19, 2024 GO-2026-5264 +3 more

GO-2026-5264: Prometheus: Remote read endpoint allows denial of service via crafted snappy payload in github.com/prometheus/prometheus

GO-2026-5381: Prometheus vulnerable to stored XSS via crafted histogram bucket label values in the old web UI heatmap display in github.com/prometheus/prometheus

GO-2026-5662: Prometheus has Stored XSS via metric names and label values in Prometheus web UI in github.com/prometheus/prometheus

GO-2026-5710: Prometheus Azure AD remote write OAuth client secret exposed via config API in github.com/prometheus/prometheus

v0.50.1

Feb 26, 2024 GO-2026-5264 +3 more

GO-2026-5264: Prometheus: Remote read endpoint allows denial of service via crafted snappy payload in github.com/prometheus/prometheus

GO-2026-5381: Prometheus vulnerable to stored XSS via crafted histogram bucket label values in the old web UI heatmap display in github.com/prometheus/prometheus

GO-2026-5662: Prometheus has Stored XSS via metric names and label values in Prometheus web UI in github.com/prometheus/prometheus

GO-2026-5710: Prometheus Azure AD remote write OAuth client secret exposed via config API in github.com/prometheus/prometheus

v0.50.0

Feb 22, 2024 GO-2026-5264 +3 more

GO-2026-5264: Prometheus: Remote read endpoint allows denial of service via crafted snappy payload in github.com/prometheus/prometheus

GO-2026-5381: Prometheus vulnerable to stored XSS via crafted histogram bucket label values in the old web UI heatmap display in github.com/prometheus/prometheus

GO-2026-5662: Prometheus has Stored XSS via metric names and label values in Prometheus web UI in github.com/prometheus/prometheus

GO-2026-5710: Prometheus Azure AD remote write OAuth client secret exposed via config API in github.com/prometheus/prometheus

Changes in this version

+ func ParseMetricSelectors(matchers []string) (m [][]*labels.Matcher, err error)

v0.50.0-rc.1

Feb 19, 2024 GO-2026-5264 +3 more

GO-2026-5264: Prometheus: Remote read endpoint allows denial of service via crafted snappy payload in github.com/prometheus/prometheus

GO-2026-5381: Prometheus vulnerable to stored XSS via crafted histogram bucket label values in the old web UI heatmap display in github.com/prometheus/prometheus

GO-2026-5662: Prometheus has Stored XSS via metric names and label values in Prometheus web UI in github.com/prometheus/prometheus

GO-2026-5710: Prometheus Azure AD remote write OAuth client secret exposed via config API in github.com/prometheus/prometheus

v0.50.0-rc.0

Feb 13, 2024 GO-2026-5264 +3 more

GO-2026-5264: Prometheus: Remote read endpoint allows denial of service via crafted snappy payload in github.com/prometheus/prometheus

GO-2026-5381: Prometheus vulnerable to stored XSS via crafted histogram bucket label values in the old web UI heatmap display in github.com/prometheus/prometheus

GO-2026-5662: Prometheus has Stored XSS via metric names and label values in Prometheus web UI in github.com/prometheus/prometheus

GO-2026-5710: Prometheus Azure AD remote write OAuth client secret exposed via config API in github.com/prometheus/prometheus

v0.49.1

Jan 15, 2024 GO-2026-5264 +3 more

GO-2026-5264: Prometheus: Remote read endpoint allows denial of service via crafted snappy payload in github.com/prometheus/prometheus

GO-2026-5381: Prometheus vulnerable to stored XSS via crafted histogram bucket label values in the old web UI heatmap display in github.com/prometheus/prometheus

GO-2026-5662: Prometheus has Stored XSS via metric names and label values in Prometheus web UI in github.com/prometheus/prometheus

GO-2026-5710: Prometheus Azure AD remote write OAuth client secret exposed via config API in github.com/prometheus/prometheus

v0.49.0

Jan 15, 2024 GO-2026-5264 +3 more

GO-2026-5264: Prometheus: Remote read endpoint allows denial of service via crafted snappy payload in github.com/prometheus/prometheus

GO-2026-5381: Prometheus vulnerable to stored XSS via crafted histogram bucket label values in the old web UI heatmap display in github.com/prometheus/prometheus

GO-2026-5662: Prometheus has Stored XSS via metric names and label values in Prometheus web UI in github.com/prometheus/prometheus

GO-2026-5710: Prometheus Azure AD remote write OAuth client secret exposed via config API in github.com/prometheus/prometheus

Changes in this version

+ var EnableExperimentalFunctions bool

type Function

+ Experimental bool

v0.49.0-rc.2

Jan 8, 2024 GO-2026-5264 +3 more

GO-2026-5264: Prometheus: Remote read endpoint allows denial of service via crafted snappy payload in github.com/prometheus/prometheus

GO-2026-5381: Prometheus vulnerable to stored XSS via crafted histogram bucket label values in the old web UI heatmap display in github.com/prometheus/prometheus

GO-2026-5662: Prometheus has Stored XSS via metric names and label values in Prometheus web UI in github.com/prometheus/prometheus

GO-2026-5710: Prometheus Azure AD remote write OAuth client secret exposed via config API in github.com/prometheus/prometheus

v0.49.0-rc.1

Dec 20, 2023 GO-2026-5264 +3 more

GO-2026-5264: Prometheus: Remote read endpoint allows denial of service via crafted snappy payload in github.com/prometheus/prometheus

GO-2026-5381: Prometheus vulnerable to stored XSS via crafted histogram bucket label values in the old web UI heatmap display in github.com/prometheus/prometheus

GO-2026-5662: Prometheus has Stored XSS via metric names and label values in Prometheus web UI in github.com/prometheus/prometheus

GO-2026-5710: Prometheus Azure AD remote write OAuth client secret exposed via config API in github.com/prometheus/prometheus

v0.49.0-rc.0

Dec 12, 2023 GO-2026-5264 +3 more

GO-2026-5264: Prometheus: Remote read endpoint allows denial of service via crafted snappy payload in github.com/prometheus/prometheus

GO-2026-5381: Prometheus vulnerable to stored XSS via crafted histogram bucket label values in the old web UI heatmap display in github.com/prometheus/prometheus

GO-2026-5662: Prometheus has Stored XSS via metric names and label values in Prometheus web UI in github.com/prometheus/prometheus

GO-2026-5710: Prometheus Azure AD remote write OAuth client secret exposed via config API in github.com/prometheus/prometheus

v0.48.1

Dec 8, 2023 GO-2026-5264 +3 more

GO-2026-5264: Prometheus: Remote read endpoint allows denial of service via crafted snappy payload in github.com/prometheus/prometheus

GO-2026-5381: Prometheus vulnerable to stored XSS via crafted histogram bucket label values in the old web UI heatmap display in github.com/prometheus/prometheus

GO-2026-5662: Prometheus has Stored XSS via metric names and label values in Prometheus web UI in github.com/prometheus/prometheus

GO-2026-5710: Prometheus Azure AD remote write OAuth client secret exposed via config API in github.com/prometheus/prometheus

v0.48.0

Nov 15, 2023 GO-2026-5264 +3 more

GO-2026-5264: Prometheus: Remote read endpoint allows denial of service via crafted snappy payload in github.com/prometheus/prometheus

GO-2026-5381: Prometheus vulnerable to stored XSS via crafted histogram bucket label values in the old web UI heatmap display in github.com/prometheus/prometheus

GO-2026-5662: Prometheus has Stored XSS via metric names and label values in Prometheus web UI in github.com/prometheus/prometheus

GO-2026-5710: Prometheus Azure AD remote write OAuth client secret exposed via config API in github.com/prometheus/prometheus

v0.48.0-rc.2

Nov 2, 2023 GO-2026-5264 +3 more

GO-2026-5264: Prometheus: Remote read endpoint allows denial of service via crafted snappy payload in github.com/prometheus/prometheus

GO-2026-5381: Prometheus vulnerable to stored XSS via crafted histogram bucket label values in the old web UI heatmap display in github.com/prometheus/prometheus

GO-2026-5662: Prometheus has Stored XSS via metric names and label values in Prometheus web UI in github.com/prometheus/prometheus

GO-2026-5710: Prometheus Azure AD remote write OAuth client secret exposed via config API in github.com/prometheus/prometheus

v0.48.0-rc.1

Oct 27, 2023 GO-2026-5264 +3 more

GO-2026-5264: Prometheus: Remote read endpoint allows denial of service via crafted snappy payload in github.com/prometheus/prometheus

GO-2026-5381: Prometheus vulnerable to stored XSS via crafted histogram bucket label values in the old web UI heatmap display in github.com/prometheus/prometheus

GO-2026-5662: Prometheus has Stored XSS via metric names and label values in Prometheus web UI in github.com/prometheus/prometheus

GO-2026-5710: Prometheus Azure AD remote write OAuth client secret exposed via config API in github.com/prometheus/prometheus

v0.48.0-rc.0

Oct 17, 2023 GO-2026-5264 +3 more

GO-2026-5264: Prometheus: Remote read endpoint allows denial of service via crafted snappy payload in github.com/prometheus/prometheus

GO-2026-5381: Prometheus vulnerable to stored XSS via crafted histogram bucket label values in the old web UI heatmap display in github.com/prometheus/prometheus

GO-2026-5662: Prometheus has Stored XSS via metric names and label values in Prometheus web UI in github.com/prometheus/prometheus

GO-2026-5710: Prometheus Azure AD remote write OAuth client secret exposed via config API in github.com/prometheus/prometheus

v0.47.2

Oct 12, 2023 GO-2026-5264 +3 more

GO-2026-5264: Prometheus: Remote read endpoint allows denial of service via crafted snappy payload in github.com/prometheus/prometheus

GO-2026-5381: Prometheus vulnerable to stored XSS via crafted histogram bucket label values in the old web UI heatmap display in github.com/prometheus/prometheus

GO-2026-5662: Prometheus has Stored XSS via metric names and label values in Prometheus web UI in github.com/prometheus/prometheus

GO-2026-5710: Prometheus Azure AD remote write OAuth client secret exposed via config API in github.com/prometheus/prometheus

v0.47.1

Oct 4, 2023 GO-2026-5264 +3 more

GO-2026-5264: Prometheus: Remote read endpoint allows denial of service via crafted snappy payload in github.com/prometheus/prometheus

GO-2026-5381: Prometheus vulnerable to stored XSS via crafted histogram bucket label values in the old web UI heatmap display in github.com/prometheus/prometheus

GO-2026-5662: Prometheus has Stored XSS via metric names and label values in Prometheus web UI in github.com/prometheus/prometheus

GO-2026-5710: Prometheus Azure AD remote write OAuth client secret exposed via config API in github.com/prometheus/prometheus

v0.47.0

Sep 6, 2023 GO-2026-5264 +3 more

GO-2026-5264: Prometheus: Remote read endpoint allows denial of service via crafted snappy payload in github.com/prometheus/prometheus

GO-2026-5381: Prometheus vulnerable to stored XSS via crafted histogram bucket label values in the old web UI heatmap display in github.com/prometheus/prometheus

GO-2026-5662: Prometheus has Stored XSS via metric names and label values in Prometheus web UI in github.com/prometheus/prometheus

GO-2026-5710: Prometheus Azure AD remote write OAuth client secret exposed via config API in github.com/prometheus/prometheus

Changes in this version

+ const BUCKETS_DESC

+ const CLOSE_HIST

+ const COUNT_DESC

+ const NEGATIVE_BUCKETS_DESC

+ const NEGATIVE_OFFSET_DESC

+ const OFFSET_DESC

+ const OPEN_HIST

+ const SCHEMA_DESC

+ const SUM_DESC

+ const ZERO_BUCKET_DESC

+ const ZERO_BUCKET_WIDTH_DESC

+ func EnrichParseError(err error, enrich func(parseErr *ParseErr))

type SequenceValue

+ Histogram *histogram.FloatHistogram

v0.47.0-rc.0

Aug 31, 2023 GO-2026-5264 +3 more

GO-2026-5264: Prometheus: Remote read endpoint allows denial of service via crafted snappy payload in github.com/prometheus/prometheus

GO-2026-5381: Prometheus vulnerable to stored XSS via crafted histogram bucket label values in the old web UI heatmap display in github.com/prometheus/prometheus

GO-2026-5662: Prometheus has Stored XSS via metric names and label values in Prometheus web UI in github.com/prometheus/prometheus

GO-2026-5710: Prometheus Azure AD remote write OAuth client secret exposed via config API in github.com/prometheus/prometheus

v0.46.0

Jul 25, 2023 GO-2026-5264 +3 more

GO-2026-5264: Prometheus: Remote read endpoint allows denial of service via crafted snappy payload in github.com/prometheus/prometheus

GO-2026-5381: Prometheus vulnerable to stored XSS via crafted histogram bucket label values in the old web UI heatmap display in github.com/prometheus/prometheus

GO-2026-5662: Prometheus has Stored XSS via metric names and label values in Prometheus web UI in github.com/prometheus/prometheus

GO-2026-5710: Prometheus Azure AD remote write OAuth client secret exposed via config API in github.com/prometheus/prometheus

Changes in this version

+ func NewParser(input string, opts ...Opt) *parser

+ type Opt func(p *parser)

+ func WithFunctions(functions map[string]*Function) Opt

+ type Parser interface

+ Close func()

+ ParseExpr func() (Expr, error)

v0.46.0-rc.0

Jul 20, 2023 GO-2026-5264 +3 more

GO-2026-5264: Prometheus: Remote read endpoint allows denial of service via crafted snappy payload in github.com/prometheus/prometheus

GO-2026-5381: Prometheus vulnerable to stored XSS via crafted histogram bucket label values in the old web UI heatmap display in github.com/prometheus/prometheus

GO-2026-5662: Prometheus has Stored XSS via metric names and label values in Prometheus web UI in github.com/prometheus/prometheus

GO-2026-5710: Prometheus Azure AD remote write OAuth client secret exposed via config API in github.com/prometheus/prometheus

v0.45.6

Jun 21, 2024 GO-2026-5264 +3 more

GO-2026-5264: Prometheus: Remote read endpoint allows denial of service via crafted snappy payload in github.com/prometheus/prometheus

GO-2026-5381: Prometheus vulnerable to stored XSS via crafted histogram bucket label values in the old web UI heatmap display in github.com/prometheus/prometheus

GO-2026-5662: Prometheus has Stored XSS via metric names and label values in Prometheus web UI in github.com/prometheus/prometheus

GO-2026-5710: Prometheus Azure AD remote write OAuth client secret exposed via config API in github.com/prometheus/prometheus

v0.45.5

May 2, 2024 GO-2026-5264 +3 more

GO-2026-5264: Prometheus: Remote read endpoint allows denial of service via crafted snappy payload in github.com/prometheus/prometheus

GO-2026-5381: Prometheus vulnerable to stored XSS via crafted histogram bucket label values in the old web UI heatmap display in github.com/prometheus/prometheus

GO-2026-5662: Prometheus has Stored XSS via metric names and label values in Prometheus web UI in github.com/prometheus/prometheus

GO-2026-5710: Prometheus Azure AD remote write OAuth client secret exposed via config API in github.com/prometheus/prometheus

v0.45.4

Mar 18, 2024 GO-2026-5264 +3 more

GO-2026-5264: Prometheus: Remote read endpoint allows denial of service via crafted snappy payload in github.com/prometheus/prometheus

GO-2026-5381: Prometheus vulnerable to stored XSS via crafted histogram bucket label values in the old web UI heatmap display in github.com/prometheus/prometheus

GO-2026-5662: Prometheus has Stored XSS via metric names and label values in Prometheus web UI in github.com/prometheus/prometheus

GO-2026-5710: Prometheus Azure AD remote write OAuth client secret exposed via config API in github.com/prometheus/prometheus

v0.45.3

Jan 24, 2024 GO-2026-5264 +3 more

GO-2026-5264: Prometheus: Remote read endpoint allows denial of service via crafted snappy payload in github.com/prometheus/prometheus

GO-2026-5381: Prometheus vulnerable to stored XSS via crafted histogram bucket label values in the old web UI heatmap display in github.com/prometheus/prometheus

GO-2026-5662: Prometheus has Stored XSS via metric names and label values in Prometheus web UI in github.com/prometheus/prometheus

GO-2026-5710: Prometheus Azure AD remote write OAuth client secret exposed via config API in github.com/prometheus/prometheus

v0.45.2

Dec 19, 2023 GO-2026-5264 +3 more

GO-2026-5264: Prometheus: Remote read endpoint allows denial of service via crafted snappy payload in github.com/prometheus/prometheus

GO-2026-5381: Prometheus vulnerable to stored XSS via crafted histogram bucket label values in the old web UI heatmap display in github.com/prometheus/prometheus

GO-2026-5662: Prometheus has Stored XSS via metric names and label values in Prometheus web UI in github.com/prometheus/prometheus

GO-2026-5710: Prometheus Azure AD remote write OAuth client secret exposed via config API in github.com/prometheus/prometheus

v0.45.1

Sep 29, 2023 GO-2026-5264 +2 more

GO-2026-5264: Prometheus: Remote read endpoint allows denial of service via crafted snappy payload in github.com/prometheus/prometheus

GO-2026-5381: Prometheus vulnerable to stored XSS via crafted histogram bucket label values in the old web UI heatmap display in github.com/prometheus/prometheus

GO-2026-5662: Prometheus has Stored XSS via metric names and label values in Prometheus web UI in github.com/prometheus/prometheus

v0.45.0

Jun 23, 2023 GO-2026-5264 +2 more

GO-2026-5264: Prometheus: Remote read endpoint allows denial of service via crafted snappy payload in github.com/prometheus/prometheus

GO-2026-5381: Prometheus vulnerable to stored XSS via crafted histogram bucket label values in the old web UI heatmap display in github.com/prometheus/prometheus

GO-2026-5662: Prometheus has Stored XSS via metric names and label values in Prometheus web UI in github.com/prometheus/prometheus

v0.45.0-rc.1

Jun 20, 2023 GO-2026-5264 +2 more

GO-2026-5264: Prometheus: Remote read endpoint allows denial of service via crafted snappy payload in github.com/prometheus/prometheus

GO-2026-5381: Prometheus vulnerable to stored XSS via crafted histogram bucket label values in the old web UI heatmap display in github.com/prometheus/prometheus

GO-2026-5662: Prometheus has Stored XSS via metric names and label values in Prometheus web UI in github.com/prometheus/prometheus

v0.45.0-rc.0

Jun 7, 2023 GO-2026-5264 +2 more

GO-2026-5264: Prometheus: Remote read endpoint allows denial of service via crafted snappy payload in github.com/prometheus/prometheus

GO-2026-5381: Prometheus vulnerable to stored XSS via crafted histogram bucket label values in the old web UI heatmap display in github.com/prometheus/prometheus

GO-2026-5662: Prometheus has Stored XSS via metric names and label values in Prometheus web UI in github.com/prometheus/prometheus

v0.44.0

May 14, 2023 GO-2026-5264 +2 more

GO-2026-5264: Prometheus: Remote read endpoint allows denial of service via crafted snappy payload in github.com/prometheus/prometheus

GO-2026-5381: Prometheus vulnerable to stored XSS via crafted histogram bucket label values in the old web UI heatmap display in github.com/prometheus/prometheus

GO-2026-5662: Prometheus has Stored XSS via metric names and label values in Prometheus web UI in github.com/prometheus/prometheus

v0.44.0-rc.2

May 8, 2023 GO-2026-5264 +2 more

GO-2026-5264: Prometheus: Remote read endpoint allows denial of service via crafted snappy payload in github.com/prometheus/prometheus

GO-2026-5381: Prometheus vulnerable to stored XSS via crafted histogram bucket label values in the old web UI heatmap display in github.com/prometheus/prometheus

GO-2026-5662: Prometheus has Stored XSS via metric names and label values in Prometheus web UI in github.com/prometheus/prometheus

v0.44.0-rc.1

May 3, 2023 GO-2026-5264 +2 more

GO-2026-5264: Prometheus: Remote read endpoint allows denial of service via crafted snappy payload in github.com/prometheus/prometheus

GO-2026-5381: Prometheus vulnerable to stored XSS via crafted histogram bucket label values in the old web UI heatmap display in github.com/prometheus/prometheus

GO-2026-5662: Prometheus has Stored XSS via metric names and label values in Prometheus web UI in github.com/prometheus/prometheus

v0.44.0-rc.0

Apr 26, 2023 GO-2026-5264 +2 more

GO-2026-5264: Prometheus: Remote read endpoint allows denial of service via crafted snappy payload in github.com/prometheus/prometheus

GO-2026-5381: Prometheus vulnerable to stored XSS via crafted histogram bucket label values in the old web UI heatmap display in github.com/prometheus/prometheus

GO-2026-5662: Prometheus has Stored XSS via metric names and label values in Prometheus web UI in github.com/prometheus/prometheus

v0.43.1

May 4, 2023 GO-2026-5264 +2 more

GO-2026-5264: Prometheus: Remote read endpoint allows denial of service via crafted snappy payload in github.com/prometheus/prometheus

GO-2026-5381: Prometheus vulnerable to stored XSS via crafted histogram bucket label values in the old web UI heatmap display in github.com/prometheus/prometheus

GO-2026-5662: Prometheus has Stored XSS via metric names and label values in Prometheus web UI in github.com/prometheus/prometheus

v0.43.0

Mar 21, 2023 GO-2026-5264 +2 more

GO-2026-5264: Prometheus: Remote read endpoint allows denial of service via crafted snappy payload in github.com/prometheus/prometheus

GO-2026-5381: Prometheus vulnerable to stored XSS via crafted histogram bucket label values in the old web UI heatmap display in github.com/prometheus/prometheus

GO-2026-5662: Prometheus has Stored XSS via metric names and label values in Prometheus web UI in github.com/prometheus/prometheus

v0.43.0-rc.1

Mar 16, 2023 GO-2026-5264 +2 more

GO-2026-5264: Prometheus: Remote read endpoint allows denial of service via crafted snappy payload in github.com/prometheus/prometheus

GO-2026-5381: Prometheus vulnerable to stored XSS via crafted histogram bucket label values in the old web UI heatmap display in github.com/prometheus/prometheus

GO-2026-5662: Prometheus has Stored XSS via metric names and label values in Prometheus web UI in github.com/prometheus/prometheus

v0.43.0-rc.0

Mar 9, 2023 GO-2026-5264 +2 more

GO-2026-5264: Prometheus: Remote read endpoint allows denial of service via crafted snappy payload in github.com/prometheus/prometheus

GO-2026-5381: Prometheus vulnerable to stored XSS via crafted histogram bucket label values in the old web UI heatmap display in github.com/prometheus/prometheus

GO-2026-5662: Prometheus has Stored XSS via metric names and label values in Prometheus web UI in github.com/prometheus/prometheus

v0.42.0

Jan 31, 2023 GO-2026-5264 +2 more

GO-2026-5264: Prometheus: Remote read endpoint allows denial of service via crafted snappy payload in github.com/prometheus/prometheus

GO-2026-5381: Prometheus vulnerable to stored XSS via crafted histogram bucket label values in the old web UI heatmap display in github.com/prometheus/prometheus

GO-2026-5662: Prometheus has Stored XSS via metric names and label values in Prometheus web UI in github.com/prometheus/prometheus

v0.41.0

Dec 20, 2022 GO-2026-5264 +2 more

GO-2026-5264: Prometheus: Remote read endpoint allows denial of service via crafted snappy payload in github.com/prometheus/prometheus

GO-2026-5381: Prometheus vulnerable to stored XSS via crafted histogram bucket label values in the old web UI heatmap display in github.com/prometheus/prometheus

GO-2026-5662: Prometheus has Stored XSS via metric names and label values in Prometheus web UI in github.com/prometheus/prometheus

v0.41.0-rc.0

Dec 15, 2022 GO-2026-5264 +2 more

GO-2026-5264: Prometheus: Remote read endpoint allows denial of service via crafted snappy payload in github.com/prometheus/prometheus

GO-2026-5381: Prometheus vulnerable to stored XSS via crafted histogram bucket label values in the old web UI heatmap display in github.com/prometheus/prometheus

GO-2026-5662: Prometheus has Stored XSS via metric names and label values in Prometheus web UI in github.com/prometheus/prometheus

v0.40.7

Dec 14, 2022 GO-2026-5264 +2 more

GO-2026-5264: Prometheus: Remote read endpoint allows denial of service via crafted snappy payload in github.com/prometheus/prometheus

GO-2026-5381: Prometheus vulnerable to stored XSS via crafted histogram bucket label values in the old web UI heatmap display in github.com/prometheus/prometheus

GO-2026-5662: Prometheus has Stored XSS via metric names and label values in Prometheus web UI in github.com/prometheus/prometheus

v0.40.6

Dec 9, 2022 GO-2026-5264 +2 more

GO-2026-5264: Prometheus: Remote read endpoint allows denial of service via crafted snappy payload in github.com/prometheus/prometheus

GO-2026-5381: Prometheus vulnerable to stored XSS via crafted histogram bucket label values in the old web UI heatmap display in github.com/prometheus/prometheus

GO-2026-5662: Prometheus has Stored XSS via metric names and label values in Prometheus web UI in github.com/prometheus/prometheus

v0.40.5

Dec 1, 2022 GO-2026-5264 +2 more

GO-2026-5264: Prometheus: Remote read endpoint allows denial of service via crafted snappy payload in github.com/prometheus/prometheus

GO-2026-5381: Prometheus vulnerable to stored XSS via crafted histogram bucket label values in the old web UI heatmap display in github.com/prometheus/prometheus

GO-2026-5662: Prometheus has Stored XSS via metric names and label values in Prometheus web UI in github.com/prometheus/prometheus

v0.40.4

Nov 29, 2022 GO-2026-5264 +2 more

GO-2026-5264: Prometheus: Remote read endpoint allows denial of service via crafted snappy payload in github.com/prometheus/prometheus

GO-2026-5381: Prometheus vulnerable to stored XSS via crafted histogram bucket label values in the old web UI heatmap display in github.com/prometheus/prometheus

GO-2026-5662: Prometheus has Stored XSS via metric names and label values in Prometheus web UI in github.com/prometheus/prometheus

v0.40.3

Nov 24, 2022 GO-2026-5264 +2 more

GO-2026-5264: Prometheus: Remote read endpoint allows denial of service via crafted snappy payload in github.com/prometheus/prometheus

GO-2026-5381: Prometheus vulnerable to stored XSS via crafted histogram bucket label values in the old web UI heatmap display in github.com/prometheus/prometheus

GO-2026-5662: Prometheus has Stored XSS via metric names and label values in Prometheus web UI in github.com/prometheus/prometheus

v0.40.2

Nov 17, 2022 GO-2026-5264 +2 more

GO-2026-5264: Prometheus: Remote read endpoint allows denial of service via crafted snappy payload in github.com/prometheus/prometheus

GO-2026-5381: Prometheus vulnerable to stored XSS via crafted histogram bucket label values in the old web UI heatmap display in github.com/prometheus/prometheus

GO-2026-5662: Prometheus has Stored XSS via metric names and label values in Prometheus web UI in github.com/prometheus/prometheus

v0.40.1

Nov 9, 2022 GO-2026-5264 +2 more

GO-2026-5264: Prometheus: Remote read endpoint allows denial of service via crafted snappy payload in github.com/prometheus/prometheus

GO-2026-5381: Prometheus vulnerable to stored XSS via crafted histogram bucket label values in the old web UI heatmap display in github.com/prometheus/prometheus

GO-2026-5662: Prometheus has Stored XSS via metric names and label values in Prometheus web UI in github.com/prometheus/prometheus

v0.40.0

Nov 7, 2022 GO-2026-5264 +2 more

GO-2026-5264: Prometheus: Remote read endpoint allows denial of service via crafted snappy payload in github.com/prometheus/prometheus

GO-2026-5381: Prometheus vulnerable to stored XSS via crafted histogram bucket label values in the old web UI heatmap display in github.com/prometheus/prometheus

GO-2026-5662: Prometheus has Stored XSS via metric names and label values in Prometheus web UI in github.com/prometheus/prometheus

v0.40.0-rc.0

Nov 3, 2022 GO-2026-5264 +2 more

GO-2026-5264: Prometheus: Remote read endpoint allows denial of service via crafted snappy payload in github.com/prometheus/prometheus

GO-2026-5381: Prometheus vulnerable to stored XSS via crafted histogram bucket label values in the old web UI heatmap display in github.com/prometheus/prometheus

GO-2026-5662: Prometheus has Stored XSS via metric names and label values in Prometheus web UI in github.com/prometheus/prometheus

v0.39.2

Nov 9, 2022 GO-2026-5264 +2 more

GO-2026-5264: Prometheus: Remote read endpoint allows denial of service via crafted snappy payload in github.com/prometheus/prometheus

GO-2026-5381: Prometheus vulnerable to stored XSS via crafted histogram bucket label values in the old web UI heatmap display in github.com/prometheus/prometheus

GO-2026-5662: Prometheus has Stored XSS via metric names and label values in Prometheus web UI in github.com/prometheus/prometheus

v0.39.1

Oct 7, 2022 GO-2026-5264 +2 more

GO-2026-5264: Prometheus: Remote read endpoint allows denial of service via crafted snappy payload in github.com/prometheus/prometheus

GO-2026-5381: Prometheus vulnerable to stored XSS via crafted histogram bucket label values in the old web UI heatmap display in github.com/prometheus/prometheus

GO-2026-5662: Prometheus has Stored XSS via metric names and label values in Prometheus web UI in github.com/prometheus/prometheus

v0.39.0

Oct 5, 2022 GO-2026-5264 +2 more

GO-2026-5264: Prometheus: Remote read endpoint allows denial of service via crafted snappy payload in github.com/prometheus/prometheus

GO-2026-5381: Prometheus vulnerable to stored XSS via crafted histogram bucket label values in the old web UI heatmap display in github.com/prometheus/prometheus

GO-2026-5662: Prometheus has Stored XSS via metric names and label values in Prometheus web UI in github.com/prometheus/prometheus

v0.38.0

Aug 16, 2022 GO-2026-5264 +2 more

GO-2026-5264: Prometheus: Remote read endpoint allows denial of service via crafted snappy payload in github.com/prometheus/prometheus

GO-2026-5381: Prometheus vulnerable to stored XSS via crafted histogram bucket label values in the old web UI heatmap display in github.com/prometheus/prometheus

GO-2026-5662: Prometheus has Stored XSS via metric names and label values in Prometheus web UI in github.com/prometheus/prometheus

Changes in this version

+ func Prettify(n Node) string

type AggregateExpr

+ func (e *AggregateExpr) Pretty(level int) string

type BinaryExpr

+ func (e *BinaryExpr) Pretty(level int) string

type Call

+ func (e *Call) Pretty(level int) string

type EvalStmt

+ LookbackDelta time.Duration

+ func (e *EvalStmt) Pretty(_ int) string

type Expressions

+ func (e Expressions) Pretty(level int) string

type Item

+ func (i Item) Pretty(int) string

type MatrixSelector

+ func (e *MatrixSelector) Pretty(level int) string

type Node

+ Pretty func(level int) string

type NumberLiteral

+ func (e *NumberLiteral) Pretty(level int) string

type ParenExpr

+ func (e *ParenExpr) Pretty(level int) string

type StepInvariantExpr

+ func (e *StepInvariantExpr) Pretty(level int) string

type StringLiteral

+ func (e *StringLiteral) Pretty(level int) string

type SubqueryExpr

+ func (e *SubqueryExpr) Pretty(level int) string

type TestStmt

+ func (t TestStmt) Pretty(int) string

type UnaryExpr

+ func (e *UnaryExpr) Pretty(level int) string

type VectorSelector

+ func (e *VectorSelector) Pretty(level int) string

v0.38.0-rc.0

Aug 11, 2022 GO-2026-5264 +2 more

GO-2026-5264: Prometheus: Remote read endpoint allows denial of service via crafted snappy payload in github.com/prometheus/prometheus

GO-2026-5381: Prometheus vulnerable to stored XSS via crafted histogram bucket label values in the old web UI heatmap display in github.com/prometheus/prometheus

GO-2026-5662: Prometheus has Stored XSS via metric names and label values in Prometheus web UI in github.com/prometheus/prometheus

v0.37.9

Jul 28, 2023 GO-2026-5264 +2 more

GO-2026-5264: Prometheus: Remote read endpoint allows denial of service via crafted snappy payload in github.com/prometheus/prometheus

GO-2026-5381: Prometheus vulnerable to stored XSS via crafted histogram bucket label values in the old web UI heatmap display in github.com/prometheus/prometheus

GO-2026-5662: Prometheus has Stored XSS via metric names and label values in Prometheus web UI in github.com/prometheus/prometheus

v0.37.8

May 5, 2023 GO-2026-5264 +2 more

GO-2026-5264: Prometheus: Remote read endpoint allows denial of service via crafted snappy payload in github.com/prometheus/prometheus

GO-2026-5381: Prometheus vulnerable to stored XSS via crafted histogram bucket label values in the old web UI heatmap display in github.com/prometheus/prometheus

GO-2026-5662: Prometheus has Stored XSS via metric names and label values in Prometheus web UI in github.com/prometheus/prometheus

v0.37.7

Apr 27, 2023 GO-2026-5264 +2 more

GO-2026-5264: Prometheus: Remote read endpoint allows denial of service via crafted snappy payload in github.com/prometheus/prometheus

GO-2026-5381: Prometheus vulnerable to stored XSS via crafted histogram bucket label values in the old web UI heatmap display in github.com/prometheus/prometheus

GO-2026-5662: Prometheus has Stored XSS via metric names and label values in Prometheus web UI in github.com/prometheus/prometheus

v0.37.6

Feb 20, 2023 GO-2026-5264 +2 more

GO-2026-5264: Prometheus: Remote read endpoint allows denial of service via crafted snappy payload in github.com/prometheus/prometheus

GO-2026-5381: Prometheus vulnerable to stored XSS via crafted histogram bucket label values in the old web UI heatmap display in github.com/prometheus/prometheus

GO-2026-5662: Prometheus has Stored XSS via metric names and label values in Prometheus web UI in github.com/prometheus/prometheus

v0.37.5

Dec 9, 2022 GO-2026-5264 +2 more

GO-2026-5264: Prometheus: Remote read endpoint allows denial of service via crafted snappy payload in github.com/prometheus/prometheus

GO-2026-5381: Prometheus vulnerable to stored XSS via crafted histogram bucket label values in the old web UI heatmap display in github.com/prometheus/prometheus

GO-2026-5662: Prometheus has Stored XSS via metric names and label values in Prometheus web UI in github.com/prometheus/prometheus

v0.37.4

Nov 29, 2022 GO-2026-5264 +2 more

GO-2026-5264: Prometheus: Remote read endpoint allows denial of service via crafted snappy payload in github.com/prometheus/prometheus

GO-2026-5381: Prometheus vulnerable to stored XSS via crafted histogram bucket label values in the old web UI heatmap display in github.com/prometheus/prometheus

GO-2026-5662: Prometheus has Stored XSS via metric names and label values in Prometheus web UI in github.com/prometheus/prometheus

v0.37.3

Nov 23, 2022 GO-2026-5264 +2 more

GO-2026-5264: Prometheus: Remote read endpoint allows denial of service via crafted snappy payload in github.com/prometheus/prometheus

GO-2026-5381: Prometheus vulnerable to stored XSS via crafted histogram bucket label values in the old web UI heatmap display in github.com/prometheus/prometheus

GO-2026-5662: Prometheus has Stored XSS via metric names and label values in Prometheus web UI in github.com/prometheus/prometheus

v0.37.2

Nov 4, 2022 GO-2026-5264 +2 more

GO-2026-5264: Prometheus: Remote read endpoint allows denial of service via crafted snappy payload in github.com/prometheus/prometheus

GO-2026-5381: Prometheus vulnerable to stored XSS via crafted histogram bucket label values in the old web UI heatmap display in github.com/prometheus/prometheus

GO-2026-5662: Prometheus has Stored XSS via metric names and label values in Prometheus web UI in github.com/prometheus/prometheus

v0.37.1

Sep 12, 2022 GO-2026-5264 +2 more

GO-2026-5264: Prometheus: Remote read endpoint allows denial of service via crafted snappy payload in github.com/prometheus/prometheus

GO-2026-5381: Prometheus vulnerable to stored XSS via crafted histogram bucket label values in the old web UI heatmap display in github.com/prometheus/prometheus

GO-2026-5662: Prometheus has Stored XSS via metric names and label values in Prometheus web UI in github.com/prometheus/prometheus

v0.37.0

Jul 14, 2022 GO-2026-5264 +2 more

GO-2026-5264: Prometheus: Remote read endpoint allows denial of service via crafted snappy payload in github.com/prometheus/prometheus

GO-2026-5381: Prometheus vulnerable to stored XSS via crafted histogram bucket label values in the old web UI heatmap display in github.com/prometheus/prometheus

GO-2026-5662: Prometheus has Stored XSS via metric names and label values in Prometheus web UI in github.com/prometheus/prometheus

v0.37.0-rc.1

Jul 11, 2022 GO-2026-5264 +2 more

GO-2026-5264: Prometheus: Remote read endpoint allows denial of service via crafted snappy payload in github.com/prometheus/prometheus

GO-2026-5381: Prometheus vulnerable to stored XSS via crafted histogram bucket label values in the old web UI heatmap display in github.com/prometheus/prometheus

GO-2026-5662: Prometheus has Stored XSS via metric names and label values in Prometheus web UI in github.com/prometheus/prometheus

v0.37.0-rc.0

Jul 5, 2022 GO-2026-5264 +2 more

GO-2026-5264: Prometheus: Remote read endpoint allows denial of service via crafted snappy payload in github.com/prometheus/prometheus

GO-2026-5381: Prometheus vulnerable to stored XSS via crafted histogram bucket label values in the old web UI heatmap display in github.com/prometheus/prometheus

GO-2026-5662: Prometheus has Stored XSS via metric names and label values in Prometheus web UI in github.com/prometheus/prometheus

v0.36.2

Jun 20, 2022 GO-2026-5264 +2 more

GO-2026-5264: Prometheus: Remote read endpoint allows denial of service via crafted snappy payload in github.com/prometheus/prometheus

GO-2026-5381: Prometheus vulnerable to stored XSS via crafted histogram bucket label values in the old web UI heatmap display in github.com/prometheus/prometheus

GO-2026-5662: Prometheus has Stored XSS via metric names and label values in Prometheus web UI in github.com/prometheus/prometheus

v0.36.1

Jun 9, 2022 GO-2026-5264 +2 more

GO-2026-5264: Prometheus: Remote read endpoint allows denial of service via crafted snappy payload in github.com/prometheus/prometheus

GO-2026-5381: Prometheus vulnerable to stored XSS via crafted histogram bucket label values in the old web UI heatmap display in github.com/prometheus/prometheus

GO-2026-5662: Prometheus has Stored XSS via metric names and label values in Prometheus web UI in github.com/prometheus/prometheus

v0.36.0

May 30, 2022 GO-2026-5264 +2 more

GO-2026-5264: Prometheus: Remote read endpoint allows denial of service via crafted snappy payload in github.com/prometheus/prometheus

GO-2026-5381: Prometheus vulnerable to stored XSS via crafted histogram bucket label values in the old web UI heatmap display in github.com/prometheus/prometheus

GO-2026-5662: Prometheus has Stored XSS via metric names and label values in Prometheus web UI in github.com/prometheus/prometheus

v0.36.0-rc0

May 25, 2022 GO-2026-5264 +2 more

GO-2026-5264: Prometheus: Remote read endpoint allows denial of service via crafted snappy payload in github.com/prometheus/prometheus

GO-2026-5381: Prometheus vulnerable to stored XSS via crafted histogram bucket label values in the old web UI heatmap display in github.com/prometheus/prometheus

GO-2026-5662: Prometheus has Stored XSS via metric names and label values in Prometheus web UI in github.com/prometheus/prometheus

v0.35.0

Apr 21, 2022 GO-2026-5264 +2 more

GO-2026-5264: Prometheus: Remote read endpoint allows denial of service via crafted snappy payload in github.com/prometheus/prometheus

GO-2026-5381: Prometheus vulnerable to stored XSS via crafted histogram bucket label values in the old web UI heatmap display in github.com/prometheus/prometheus

GO-2026-5662: Prometheus has Stored XSS via metric names and label values in Prometheus web UI in github.com/prometheus/prometheus

Changes in this version

+ const ADD

+ const AT

+ const ATAN2

+ const AVG

+ const BLANK

+ const BOOL

+ const BOTTOMK

+ const BY

+ const COLON

+ const COMMA

+ const COMMENT

+ const COUNT

+ const COUNT_VALUES

+ const DIV

+ const DURATION

+ const END

+ const EOF

+ const EQL

+ const EQLC

+ const EQL_REGEX

+ const ERROR

+ const GROUP

+ const GROUP_LEFT

+ const GROUP_RIGHT

+ const GTE

+ const GTR

+ const IDENTIFIER

+ const IGNORING

+ const LAND

+ const LEFT_BRACE

+ const LEFT_BRACKET

+ const LEFT_PAREN

+ const LOR

+ const LSS

+ const LTE

+ const LUNLESS

+ const MAX

+ const METRIC_IDENTIFIER

+ const MIN

+ const MOD

+ const MUL

+ const NEQ

+ const NEQ_REGEX

+ const NUMBER

+ const OFFSET

+ const ON

+ const POW

+ const QUANTILE

+ const RIGHT_BRACE

+ const RIGHT_BRACKET

+ const RIGHT_PAREN

+ const SEMICOLON

+ const SPACE

+ const START

+ const START_EXPRESSION

+ const START_METRIC

+ const START_METRIC_SELECTOR

+ const START_SERIES_DESCRIPTION

+ const STDDEV

+ const STDVAR

+ const STRING

+ const SUB

+ const SUM

+ const TIMES

+ const TOPK

+ const WITHOUT

+ var Functions = map[string]*Function

+ var ItemTypeStr = map[ItemType]string

+ func DocumentedType(t ValueType) string

+ func ExtractSelectors(expr Expr) [][]*labels.Matcher

+ func Inspect(node Node, f inspector)

+ func MustLabelMatcher(mt labels.MatchType, name, val string) *labels.Matcher

+ func ParseMetric(input string) (m labels.Labels, err error)

+ func ParseMetricSelector(input string) (m []*labels.Matcher, err error)

+ func Tree(node Node) string

+ func Walk(v Visitor, node Node, path []Node) error

+ type AggregateExpr struct

+ Expr Expr

+ Grouping []string

+ Op ItemType

+ Param Expr

+ PosRange PositionRange

+ Without bool

+ func (*AggregateExpr) PromQLExpr()

+ func (e *AggregateExpr) PositionRange() PositionRange

+ func (e *AggregateExpr) Type() ValueType

+ func (node *AggregateExpr) String() string

+ type BinaryExpr struct

+ LHS Expr

+ Op ItemType

+ RHS Expr

+ ReturnBool bool

+ VectorMatching *VectorMatching

+ func (*BinaryExpr) PromQLExpr()

+ func (e *BinaryExpr) PositionRange() PositionRange

+ func (e *BinaryExpr) Type() ValueType

+ func (node *BinaryExpr) String() string

+ type Call struct

+ Args Expressions

+ Func *Function

+ PosRange PositionRange

+ func (*Call) PromQLExpr()

+ func (e *Call) PositionRange() PositionRange

+ func (e *Call) Type() ValueType

+ func (node *Call) String() string

+ type EvalStmt struct

+ End time.Time

+ Expr Expr

+ Interval time.Duration

+ Start time.Time

+ func (*EvalStmt) PromQLStmt()

+ func (e *EvalStmt) PositionRange() PositionRange

+ func (node *EvalStmt) String() string

+ type Expr interface

+ PromQLExpr func()

+ Type func() ValueType

+ func ParseExpr(input string) (expr Expr, err error)

+ type Expressions []Expr

+ func (e Expressions) PositionRange() PositionRange

+ func (es Expressions) String() (s string)

+ type Function struct

+ ArgTypes []ValueType

+ Name string

+ ReturnType ValueType

+ Variadic int

+ func MustGetFunction(name string) *Function

+ type Item struct

+ Pos Pos

+ Typ ItemType

+ Val string

+ func (i *Item) PositionRange() PositionRange

+ func (i Item) String() string

+ type ItemType int

+ func (i ItemType) IsAggregator() bool

+ func (i ItemType) IsAggregatorWithParam() bool

+ func (i ItemType) IsComparisonOperator() bool

+ func (i ItemType) IsKeyword() bool

+ func (i ItemType) IsOperator() bool

+ func (i ItemType) IsSetOperator() bool

+ func (i ItemType) String() string

+ type Lexer struct

+ func Lex(input string) *Lexer

+ func (l *Lexer) NextItem(itemp *Item)

+ type MatrixSelector struct

+ EndPos Pos

+ Range time.Duration

+ VectorSelector Expr

+ func (*MatrixSelector) PromQLExpr()

+ func (e *MatrixSelector) PositionRange() PositionRange

+ func (e *MatrixSelector) Type() ValueType

+ func (node *MatrixSelector) String() string

+ type Node interface

+ PositionRange func() PositionRange

+ String func() string

+ func Children(node Node) []Node

+ type NumberLiteral struct

+ PosRange PositionRange

+ Val float64

+ func (*NumberLiteral) PromQLExpr()

+ func (e *NumberLiteral) PositionRange() PositionRange

+ func (e *NumberLiteral) Type() ValueType

+ func (node *NumberLiteral) String() string

+ type ParenExpr struct

+ Expr Expr

+ PosRange PositionRange

+ func (*ParenExpr) PromQLExpr()

+ func (e *ParenExpr) PositionRange() PositionRange

+ func (e *ParenExpr) Type() ValueType

+ func (node *ParenExpr) String() string

+ type ParseErr struct

+ Err error

+ LineOffset int

+ PositionRange PositionRange

+ Query string

+ func (e *ParseErr) Error() string

+ type ParseErrors []ParseErr

+ func (errs ParseErrors) Error() string

+ type Pos int

+ type PositionRange struct

+ End Pos

+ Start Pos

+ type SequenceValue struct

+ Omitted bool

+ Value float64

+ func ParseSeriesDesc(input string) (labels labels.Labels, values []SequenceValue, err error)

+ func (v SequenceValue) String() string

+ type Statement interface

+ PromQLStmt func()

+ type StepInvariantExpr struct

+ Expr Expr

+ func (*StepInvariantExpr) PromQLExpr()

+ func (e *StepInvariantExpr) PositionRange() PositionRange

+ func (e *StepInvariantExpr) String() string

+ func (e *StepInvariantExpr) Type() ValueType

+ type StringLiteral struct

+ PosRange PositionRange

+ Val string

+ func (*StringLiteral) PromQLExpr()

+ func (e *StringLiteral) PositionRange() PositionRange

+ func (e *StringLiteral) Type() ValueType

+ func (node *StringLiteral) String() string

+ type SubqueryExpr struct

+ EndPos Pos

+ Expr Expr

+ Offset time.Duration

+ OriginalOffset time.Duration

+ Range time.Duration

+ StartOrEnd ItemType

+ Step time.Duration

+ Timestamp *int64

+ func (*SubqueryExpr) PromQLExpr()

+ func (e *SubqueryExpr) PositionRange() PositionRange

+ func (e *SubqueryExpr) Type() ValueType

+ func (node *SubqueryExpr) String() string

+ type TestStmt func(context.Context) error

+ func (TestStmt) PositionRange() PositionRange

+ func (TestStmt) PromQLStmt()

+ func (TestStmt) String() string

+ type UnaryExpr struct

+ Expr Expr

+ Op ItemType

+ StartPos Pos

+ func (*UnaryExpr) PromQLExpr()

+ func (e *UnaryExpr) PositionRange() PositionRange

+ func (e *UnaryExpr) Type() ValueType

+ func (node *UnaryExpr) String() string

+ type Value interface

+ String func() string

+ Type func() ValueType

+ type ValueType string

+ const ValueTypeMatrix

+ const ValueTypeNone

+ const ValueTypeScalar

+ const ValueTypeString

+ const ValueTypeVector

+ type VectorMatchCardinality int

+ const CardManyToMany

+ const CardManyToOne

+ const CardOneToMany

+ const CardOneToOne

+ func (vmc VectorMatchCardinality) String() string

+ type VectorMatching struct

+ Card VectorMatchCardinality

+ Include []string

+ MatchingLabels []string

+ On bool

+ type VectorSelector struct

+ LabelMatchers []*labels.Matcher

+ Name string

+ Offset time.Duration

+ OriginalOffset time.Duration

+ PosRange PositionRange

+ Series []storage.Series

+ StartOrEnd ItemType

+ Timestamp *int64

+ UnexpandedSeriesSet storage.SeriesSet

+ func (*VectorSelector) PromQLExpr()

+ func (e *VectorSelector) PositionRange() PositionRange

+ func (e *VectorSelector) Type() ValueType

+ func (node *VectorSelector) String() string

+ type Visitor interface

+ Visit func(node Node, path []Node) (w Visitor, err error)

v0.35.0-rc1

Apr 14, 2022 GO-2026-5264 +2 more

GO-2026-5264: Prometheus: Remote read endpoint allows denial of service via crafted snappy payload in github.com/prometheus/prometheus

GO-2026-5381: Prometheus vulnerable to stored XSS via crafted histogram bucket label values in the old web UI heatmap display in github.com/prometheus/prometheus

GO-2026-5662: Prometheus has Stored XSS via metric names and label values in Prometheus web UI in github.com/prometheus/prometheus

?	: This menu
/	: Search site
f or F	: Jump to
y or Y	: Canonical URL