annotations

package

Go to main page

Versions in this module

v0

v0.313.1

Jul 10, 2026

v0.313.0

Jul 1, 2026

v0.313.0-rc.1

Jun 22, 2026

v0.312.0

May 28, 2026

Changes in this version

+ var SortInRangeQueryWarning = fmt.Errorf(...)

+ func NewSortInRangeQueryWarning(pos posrange.PositionRange) error

v0.312.0-rc.0

May 19, 2026

v0.311.3

Apr 27, 2026

v0.311.2

Apr 13, 2026 GO-2026-5264 +2 more

GO-2026-5264: Prometheus: Remote read endpoint allows denial of service via crafted snappy payload in github.com/prometheus/prometheus

GO-2026-5381: Prometheus vulnerable to stored XSS via crafted histogram bucket label values in the old web UI heatmap display in github.com/prometheus/prometheus

GO-2026-5710: Prometheus Azure AD remote write OAuth client secret exposed via config API in github.com/prometheus/prometheus

v0.311.1

Apr 7, 2026 GO-2026-5264 +3 more

GO-2026-5264: Prometheus: Remote read endpoint allows denial of service via crafted snappy payload in github.com/prometheus/prometheus

GO-2026-5381: Prometheus vulnerable to stored XSS via crafted histogram bucket label values in the old web UI heatmap display in github.com/prometheus/prometheus

GO-2026-5662: Prometheus has Stored XSS via metric names and label values in Prometheus web UI in github.com/prometheus/prometheus

GO-2026-5710: Prometheus Azure AD remote write OAuth client secret exposed via config API in github.com/prometheus/prometheus

v0.311.0

Apr 2, 2026 GO-2026-5264 +3 more

GO-2026-5264: Prometheus: Remote read endpoint allows denial of service via crafted snappy payload in github.com/prometheus/prometheus

GO-2026-5381: Prometheus vulnerable to stored XSS via crafted histogram bucket label values in the old web UI heatmap display in github.com/prometheus/prometheus

GO-2026-5662: Prometheus has Stored XSS via metric names and label values in Prometheus web UI in github.com/prometheus/prometheus

GO-2026-5710: Prometheus Azure AD remote write OAuth client secret exposed via config API in github.com/prometheus/prometheus

v0.310.0

Feb 25, 2026 GO-2026-5264 +3 more

GO-2026-5264: Prometheus: Remote read endpoint allows denial of service via crafted snappy payload in github.com/prometheus/prometheus

GO-2026-5381: Prometheus vulnerable to stored XSS via crafted histogram bucket label values in the old web UI heatmap display in github.com/prometheus/prometheus

GO-2026-5662: Prometheus has Stored XSS via metric names and label values in Prometheus web UI in github.com/prometheus/prometheus

GO-2026-5710: Prometheus Azure AD remote write OAuth client secret exposed via config API in github.com/prometheus/prometheus

v0.310.0-rc.1

Feb 19, 2026 GO-2026-5264 +3 more

GO-2026-5264: Prometheus: Remote read endpoint allows denial of service via crafted snappy payload in github.com/prometheus/prometheus

GO-2026-5381: Prometheus vulnerable to stored XSS via crafted histogram bucket label values in the old web UI heatmap display in github.com/prometheus/prometheus

GO-2026-5662: Prometheus has Stored XSS via metric names and label values in Prometheus web UI in github.com/prometheus/prometheus

GO-2026-5710: Prometheus Azure AD remote write OAuth client secret exposed via config API in github.com/prometheus/prometheus

v0.310.0-rc.0

Feb 17, 2026 GO-2026-5264 +3 more

GO-2026-5264: Prometheus: Remote read endpoint allows denial of service via crafted snappy payload in github.com/prometheus/prometheus

GO-2026-5381: Prometheus vulnerable to stored XSS via crafted histogram bucket label values in the old web UI heatmap display in github.com/prometheus/prometheus

GO-2026-5662: Prometheus has Stored XSS via metric names and label values in Prometheus web UI in github.com/prometheus/prometheus

GO-2026-5710: Prometheus Azure AD remote write OAuth client secret exposed via config API in github.com/prometheus/prometheus

v0.309.1

Jan 7, 2026 GO-2026-5264 +3 more

GO-2026-5264: Prometheus: Remote read endpoint allows denial of service via crafted snappy payload in github.com/prometheus/prometheus

GO-2026-5381: Prometheus vulnerable to stored XSS via crafted histogram bucket label values in the old web UI heatmap display in github.com/prometheus/prometheus

GO-2026-5662: Prometheus has Stored XSS via metric names and label values in Prometheus web UI in github.com/prometheus/prometheus

GO-2026-5710: Prometheus Azure AD remote write OAuth client secret exposed via config API in github.com/prometheus/prometheus

v0.309.0

Jan 6, 2026 GO-2026-5264 +3 more

GO-2026-5264: Prometheus: Remote read endpoint allows denial of service via crafted snappy payload in github.com/prometheus/prometheus

GO-2026-5381: Prometheus vulnerable to stored XSS via crafted histogram bucket label values in the old web UI heatmap display in github.com/prometheus/prometheus

GO-2026-5662: Prometheus has Stored XSS via metric names and label values in Prometheus web UI in github.com/prometheus/prometheus

GO-2026-5710: Prometheus Azure AD remote write OAuth client secret exposed via config API in github.com/prometheus/prometheus

v0.308.1

Dec 16, 2025 GO-2026-5264 +3 more

GO-2026-5264: Prometheus: Remote read endpoint allows denial of service via crafted snappy payload in github.com/prometheus/prometheus

GO-2026-5381: Prometheus vulnerable to stored XSS via crafted histogram bucket label values in the old web UI heatmap display in github.com/prometheus/prometheus

GO-2026-5662: Prometheus has Stored XSS via metric names and label values in Prometheus web UI in github.com/prometheus/prometheus

GO-2026-5710: Prometheus Azure AD remote write OAuth client secret exposed via config API in github.com/prometheus/prometheus

v0.308.0

Dec 2, 2025 GO-2026-5264 +3 more

GO-2026-5264: Prometheus: Remote read endpoint allows denial of service via crafted snappy payload in github.com/prometheus/prometheus

GO-2026-5381: Prometheus vulnerable to stored XSS via crafted histogram bucket label values in the old web UI heatmap display in github.com/prometheus/prometheus

GO-2026-5662: Prometheus has Stored XSS via metric names and label values in Prometheus web UI in github.com/prometheus/prometheus

GO-2026-5710: Prometheus Azure AD remote write OAuth client secret exposed via config API in github.com/prometheus/prometheus

Changes in this version

+ var MismatchedCustomBucketsHistogramsInfo = fmt.Errorf("%w: mismatched custom buckets were reconciled during", PromQLInfo)

+ func NewMismatchedCustomBucketsHistogramsInfo(pos posrange.PositionRange, operation HistogramOperation) error

type HistogramOperation

+ func (op HistogramOperation) String() string

v0.308.0-rc.1

Nov 24, 2025 GO-2026-5264 +3 more

GO-2026-5264: Prometheus: Remote read endpoint allows denial of service via crafted snappy payload in github.com/prometheus/prometheus

GO-2026-5381: Prometheus vulnerable to stored XSS via crafted histogram bucket label values in the old web UI heatmap display in github.com/prometheus/prometheus

GO-2026-5662: Prometheus has Stored XSS via metric names and label values in Prometheus web UI in github.com/prometheus/prometheus

GO-2026-5710: Prometheus Azure AD remote write OAuth client secret exposed via config API in github.com/prometheus/prometheus

v0.308.0-rc.0

Nov 14, 2025 GO-2026-5264 +3 more

GO-2026-5264: Prometheus: Remote read endpoint allows denial of service via crafted snappy payload in github.com/prometheus/prometheus

GO-2026-5381: Prometheus vulnerable to stored XSS via crafted histogram bucket label values in the old web UI heatmap display in github.com/prometheus/prometheus

GO-2026-5662: Prometheus has Stored XSS via metric names and label values in Prometheus web UI in github.com/prometheus/prometheus

GO-2026-5710: Prometheus Azure AD remote write OAuth client secret exposed via config API in github.com/prometheus/prometheus

v0.307.3

Oct 30, 2025 GO-2026-5264 +3 more

GO-2026-5264: Prometheus: Remote read endpoint allows denial of service via crafted snappy payload in github.com/prometheus/prometheus

GO-2026-5381: Prometheus vulnerable to stored XSS via crafted histogram bucket label values in the old web UI heatmap display in github.com/prometheus/prometheus

GO-2026-5662: Prometheus has Stored XSS via metric names and label values in Prometheus web UI in github.com/prometheus/prometheus

GO-2026-5710: Prometheus Azure AD remote write OAuth client secret exposed via config API in github.com/prometheus/prometheus

v0.307.2

Oct 22, 2025 GO-2026-5264 +3 more

GO-2026-5264: Prometheus: Remote read endpoint allows denial of service via crafted snappy payload in github.com/prometheus/prometheus

GO-2026-5381: Prometheus vulnerable to stored XSS via crafted histogram bucket label values in the old web UI heatmap display in github.com/prometheus/prometheus

GO-2026-5662: Prometheus has Stored XSS via metric names and label values in Prometheus web UI in github.com/prometheus/prometheus

GO-2026-5710: Prometheus Azure AD remote write OAuth client secret exposed via config API in github.com/prometheus/prometheus

v0.307.1

Oct 17, 2025 GO-2026-5264 +3 more

GO-2026-5264: Prometheus: Remote read endpoint allows denial of service via crafted snappy payload in github.com/prometheus/prometheus

GO-2026-5381: Prometheus vulnerable to stored XSS via crafted histogram bucket label values in the old web UI heatmap display in github.com/prometheus/prometheus

GO-2026-5662: Prometheus has Stored XSS via metric names and label values in Prometheus web UI in github.com/prometheus/prometheus

GO-2026-5710: Prometheus Azure AD remote write OAuth client secret exposed via config API in github.com/prometheus/prometheus

v0.307.0

Oct 15, 2025 GO-2026-5264 +3 more

GO-2026-5264: Prometheus: Remote read endpoint allows denial of service via crafted snappy payload in github.com/prometheus/prometheus

GO-2026-5381: Prometheus vulnerable to stored XSS via crafted histogram bucket label values in the old web UI heatmap display in github.com/prometheus/prometheus

GO-2026-5662: Prometheus has Stored XSS via metric names and label values in Prometheus web UI in github.com/prometheus/prometheus

GO-2026-5710: Prometheus Azure AD remote write OAuth client secret exposed via config API in github.com/prometheus/prometheus

Changes in this version

+ var HistogramCounterResetCollisionWarning = fmt.Errorf("%w: conflicting counter resets during histogram", PromQLWarning)

+ func NewHistogramCounterResetCollisionWarning(pos posrange.PositionRange, operation HistogramOperation) error

+ type HistogramOperation string

+ const HistogramAdd

+ const HistogramAgg

+ const HistogramSub

v0.307.0-rc.0

Oct 8, 2025 GO-2026-5264 +3 more

GO-2026-5264: Prometheus: Remote read endpoint allows denial of service via crafted snappy payload in github.com/prometheus/prometheus

GO-2026-5381: Prometheus vulnerable to stored XSS via crafted histogram bucket label values in the old web UI heatmap display in github.com/prometheus/prometheus

GO-2026-5662: Prometheus has Stored XSS via metric names and label values in Prometheus web UI in github.com/prometheus/prometheus

GO-2026-5710: Prometheus Azure AD remote write OAuth client secret exposed via config API in github.com/prometheus/prometheus

v0.306.0

Sep 17, 2025 GO-2026-5264 +3 more

GO-2026-5264: Prometheus: Remote read endpoint allows denial of service via crafted snappy payload in github.com/prometheus/prometheus

GO-2026-5381: Prometheus vulnerable to stored XSS via crafted histogram bucket label values in the old web UI heatmap display in github.com/prometheus/prometheus

GO-2026-5662: Prometheus has Stored XSS via metric names and label values in Prometheus web UI in github.com/prometheus/prometheus

GO-2026-5710: Prometheus Azure AD remote write OAuth client secret exposed via config API in github.com/prometheus/prometheus

v0.306.0-rc.1

Sep 10, 2025 GO-2026-5381 +2 more

GO-2026-5381: Prometheus vulnerable to stored XSS via crafted histogram bucket label values in the old web UI heatmap display in github.com/prometheus/prometheus

GO-2026-5662: Prometheus has Stored XSS via metric names and label values in Prometheus web UI in github.com/prometheus/prometheus

GO-2026-5710: Prometheus Azure AD remote write OAuth client secret exposed via config API in github.com/prometheus/prometheus

v0.306.0-rc.0

Aug 21, 2025 GO-2026-5381 +2 more

GO-2026-5381: Prometheus vulnerable to stored XSS via crafted histogram bucket label values in the old web UI heatmap display in github.com/prometheus/prometheus

GO-2026-5662: Prometheus has Stored XSS via metric names and label values in Prometheus web UI in github.com/prometheus/prometheus

GO-2026-5710: Prometheus Azure AD remote write OAuth client secret exposed via config API in github.com/prometheus/prometheus

v0.305.5

Jul 8, 2026 GO-2026-5381 +2 more

GO-2026-5381: Prometheus vulnerable to stored XSS via crafted histogram bucket label values in the old web UI heatmap display in github.com/prometheus/prometheus

GO-2026-5662: Prometheus has Stored XSS via metric names and label values in Prometheus web UI in github.com/prometheus/prometheus

GO-2026-5710: Prometheus Azure AD remote write OAuth client secret exposed via config API in github.com/prometheus/prometheus

v0.305.4

Jun 17, 2026 GO-2026-5381 +2 more

GO-2026-5381: Prometheus vulnerable to stored XSS via crafted histogram bucket label values in the old web UI heatmap display in github.com/prometheus/prometheus

GO-2026-5662: Prometheus has Stored XSS via metric names and label values in Prometheus web UI in github.com/prometheus/prometheus

GO-2026-5710: Prometheus Azure AD remote write OAuth client secret exposed via config API in github.com/prometheus/prometheus

v0.305.3

Apr 27, 2026 GO-2026-5381 +2 more

GO-2026-5381: Prometheus vulnerable to stored XSS via crafted histogram bucket label values in the old web UI heatmap display in github.com/prometheus/prometheus

GO-2026-5662: Prometheus has Stored XSS via metric names and label values in Prometheus web UI in github.com/prometheus/prometheus

GO-2026-5710: Prometheus Azure AD remote write OAuth client secret exposed via config API in github.com/prometheus/prometheus

v0.305.2

Apr 13, 2026 GO-2026-5381 +2 more

GO-2026-5381: Prometheus vulnerable to stored XSS via crafted histogram bucket label values in the old web UI heatmap display in github.com/prometheus/prometheus

GO-2026-5662: Prometheus has Stored XSS via metric names and label values in Prometheus web UI in github.com/prometheus/prometheus

GO-2026-5710: Prometheus Azure AD remote write OAuth client secret exposed via config API in github.com/prometheus/prometheus

v0.305.1

Jan 21, 2026 GO-2026-5264 +3 more

GO-2026-5264: Prometheus: Remote read endpoint allows denial of service via crafted snappy payload in github.com/prometheus/prometheus

GO-2026-5381: Prometheus vulnerable to stored XSS via crafted histogram bucket label values in the old web UI heatmap display in github.com/prometheus/prometheus

GO-2026-5662: Prometheus has Stored XSS via metric names and label values in Prometheus web UI in github.com/prometheus/prometheus

GO-2026-5710: Prometheus Azure AD remote write OAuth client secret exposed via config API in github.com/prometheus/prometheus

v0.305.0

Jul 14, 2025 GO-2026-5264 +3 more

GO-2026-5264: Prometheus: Remote read endpoint allows denial of service via crafted snappy payload in github.com/prometheus/prometheus

GO-2026-5381: Prometheus vulnerable to stored XSS via crafted histogram bucket label values in the old web UI heatmap display in github.com/prometheus/prometheus

GO-2026-5662: Prometheus has Stored XSS via metric names and label values in Prometheus web UI in github.com/prometheus/prometheus

GO-2026-5710: Prometheus Azure AD remote write OAuth client secret exposed via config API in github.com/prometheus/prometheus

Changes in this version

+ var NativeHistogramFractionNaNsInfo = fmt.Errorf(...)

+ var NativeHistogramQuantileNaNResultInfo = fmt.Errorf(...)

+ var NativeHistogramQuantileNaNSkewInfo = fmt.Errorf(...)

+ var PossibleNonCounterLabelInfo = fmt.Errorf("%w: metric might not be a counter, __type__ label is not set to %q", ...)

+ func NewNativeHistogramFractionNaNsInfo(metricName string, pos posrange.PositionRange) error

+ func NewNativeHistogramQuantileNaNResultInfo(metricName string, pos posrange.PositionRange) error

+ func NewNativeHistogramQuantileNaNSkewInfo(metricName string, pos posrange.PositionRange) error

+ func NewPossibleNonCounterLabelInfo(metricName, typeLabel string, pos posrange.PositionRange) error

v0.304.2

Jun 26, 2025 GO-2026-5264 +3 more

GO-2026-5264: Prometheus: Remote read endpoint allows denial of service via crafted snappy payload in github.com/prometheus/prometheus

GO-2026-5381: Prometheus vulnerable to stored XSS via crafted histogram bucket label values in the old web UI heatmap display in github.com/prometheus/prometheus

GO-2026-5662: Prometheus has Stored XSS via metric names and label values in Prometheus web UI in github.com/prometheus/prometheus

GO-2026-5710: Prometheus Azure AD remote write OAuth client secret exposed via config API in github.com/prometheus/prometheus

v0.304.1

May 31, 2025 GO-2026-5264 +3 more

GO-2026-5264: Prometheus: Remote read endpoint allows denial of service via crafted snappy payload in github.com/prometheus/prometheus

GO-2026-5381: Prometheus vulnerable to stored XSS via crafted histogram bucket label values in the old web UI heatmap display in github.com/prometheus/prometheus

GO-2026-5662: Prometheus has Stored XSS via metric names and label values in Prometheus web UI in github.com/prometheus/prometheus

GO-2026-5710: Prometheus Azure AD remote write OAuth client secret exposed via config API in github.com/prometheus/prometheus

v0.304.0

May 17, 2025 GO-2026-5264 +3 more

GO-2026-5264: Prometheus: Remote read endpoint allows denial of service via crafted snappy payload in github.com/prometheus/prometheus

GO-2026-5381: Prometheus vulnerable to stored XSS via crafted histogram bucket label values in the old web UI heatmap display in github.com/prometheus/prometheus

GO-2026-5662: Prometheus has Stored XSS via metric names and label values in Prometheus web UI in github.com/prometheus/prometheus

GO-2026-5710: Prometheus Azure AD remote write OAuth client secret exposed via config API in github.com/prometheus/prometheus

v0.304.0-rc.0

May 2, 2025 GO-2026-5264 +3 more

GO-2026-5264: Prometheus: Remote read endpoint allows denial of service via crafted snappy payload in github.com/prometheus/prometheus

GO-2026-5381: Prometheus vulnerable to stored XSS via crafted histogram bucket label values in the old web UI heatmap display in github.com/prometheus/prometheus

GO-2026-5662: Prometheus has Stored XSS via metric names and label values in Prometheus web UI in github.com/prometheus/prometheus

GO-2026-5710: Prometheus Azure AD remote write OAuth client secret exposed via config API in github.com/prometheus/prometheus

v0.303.1

May 2, 2025 GO-2026-5264 +3 more

GO-2026-5264: Prometheus: Remote read endpoint allows denial of service via crafted snappy payload in github.com/prometheus/prometheus

GO-2026-5381: Prometheus vulnerable to stored XSS via crafted histogram bucket label values in the old web UI heatmap display in github.com/prometheus/prometheus

GO-2026-5662: Prometheus has Stored XSS via metric names and label values in Prometheus web UI in github.com/prometheus/prometheus

GO-2026-5710: Prometheus Azure AD remote write OAuth client secret exposed via config API in github.com/prometheus/prometheus

v0.303.0

Apr 15, 2025 GO-2026-5264 +3 more

GO-2026-5264: Prometheus: Remote read endpoint allows denial of service via crafted snappy payload in github.com/prometheus/prometheus

GO-2026-5381: Prometheus vulnerable to stored XSS via crafted histogram bucket label values in the old web UI heatmap display in github.com/prometheus/prometheus

GO-2026-5662: Prometheus has Stored XSS via metric names and label values in Prometheus web UI in github.com/prometheus/prometheus

GO-2026-5710: Prometheus Azure AD remote write OAuth client secret exposed via config API in github.com/prometheus/prometheus

Changes in this version

+ var IncompatibleBucketLayoutInBinOpWarning = fmt.Errorf("%w: incompatible bucket layout encountered for binary operator", ...)

+ func NewIncompatibleBucketLayoutInBinOpWarning(operator string, pos posrange.PositionRange) error

v0.303.0-rc.1

Apr 3, 2025 GO-2026-5264 +3 more

GO-2026-5264: Prometheus: Remote read endpoint allows denial of service via crafted snappy payload in github.com/prometheus/prometheus

GO-2026-5381: Prometheus vulnerable to stored XSS via crafted histogram bucket label values in the old web UI heatmap display in github.com/prometheus/prometheus

GO-2026-5662: Prometheus has Stored XSS via metric names and label values in Prometheus web UI in github.com/prometheus/prometheus

GO-2026-5710: Prometheus Azure AD remote write OAuth client secret exposed via config API in github.com/prometheus/prometheus

v0.303.0-rc.0

Mar 26, 2025 GO-2026-5264 +3 more

GO-2026-5264: Prometheus: Remote read endpoint allows denial of service via crafted snappy payload in github.com/prometheus/prometheus

GO-2026-5381: Prometheus vulnerable to stored XSS via crafted histogram bucket label values in the old web UI heatmap display in github.com/prometheus/prometheus

GO-2026-5662: Prometheus has Stored XSS via metric names and label values in Prometheus web UI in github.com/prometheus/prometheus

GO-2026-5710: Prometheus Azure AD remote write OAuth client secret exposed via config API in github.com/prometheus/prometheus

v0.302.1

Feb 25, 2025 GO-2026-5264 +3 more

GO-2026-5264: Prometheus: Remote read endpoint allows denial of service via crafted snappy payload in github.com/prometheus/prometheus

GO-2026-5381: Prometheus vulnerable to stored XSS via crafted histogram bucket label values in the old web UI heatmap display in github.com/prometheus/prometheus

GO-2026-5662: Prometheus has Stored XSS via metric names and label values in Prometheus web UI in github.com/prometheus/prometheus

GO-2026-5710: Prometheus Azure AD remote write OAuth client secret exposed via config API in github.com/prometheus/prometheus

v0.302.0

Feb 17, 2025 GO-2026-5264 +3 more

GO-2026-5264: Prometheus: Remote read endpoint allows denial of service via crafted snappy payload in github.com/prometheus/prometheus

GO-2026-5381: Prometheus vulnerable to stored XSS via crafted histogram bucket label values in the old web UI heatmap display in github.com/prometheus/prometheus

GO-2026-5662: Prometheus has Stored XSS via metric names and label values in Prometheus web UI in github.com/prometheus/prometheus

GO-2026-5710: Prometheus Azure AD remote write OAuth client secret exposed via config API in github.com/prometheus/prometheus

Changes in this version

+ var HistogramIgnoredInMixedRangeInfo = fmt.Errorf(...)

+ func NewHistogramIgnoredInMixedRangeInfo(metricName string, pos posrange.PositionRange) error

v0.302.0-rc.1

Feb 4, 2025 GO-2026-5264 +3 more

GO-2026-5264: Prometheus: Remote read endpoint allows denial of service via crafted snappy payload in github.com/prometheus/prometheus

GO-2026-5381: Prometheus vulnerable to stored XSS via crafted histogram bucket label values in the old web UI heatmap display in github.com/prometheus/prometheus

GO-2026-5662: Prometheus has Stored XSS via metric names and label values in Prometheus web UI in github.com/prometheus/prometheus

GO-2026-5710: Prometheus Azure AD remote write OAuth client secret exposed via config API in github.com/prometheus/prometheus

v0.302.0-rc.0

Feb 4, 2025 GO-2026-5264 +3 more

GO-2026-5264: Prometheus: Remote read endpoint allows denial of service via crafted snappy payload in github.com/prometheus/prometheus

GO-2026-5381: Prometheus vulnerable to stored XSS via crafted histogram bucket label values in the old web UI heatmap display in github.com/prometheus/prometheus

GO-2026-5662: Prometheus has Stored XSS via metric names and label values in Prometheus web UI in github.com/prometheus/prometheus

GO-2026-5710: Prometheus Azure AD remote write OAuth client secret exposed via config API in github.com/prometheus/prometheus

v0.301.0

Jan 2, 2025 GO-2026-5264 +3 more

GO-2026-5264: Prometheus: Remote read endpoint allows denial of service via crafted snappy payload in github.com/prometheus/prometheus

GO-2026-5381: Prometheus vulnerable to stored XSS via crafted histogram bucket label values in the old web UI heatmap display in github.com/prometheus/prometheus

GO-2026-5662: Prometheus has Stored XSS via metric names and label values in Prometheus web UI in github.com/prometheus/prometheus

GO-2026-5710: Prometheus Azure AD remote write OAuth client secret exposed via config API in github.com/prometheus/prometheus

Changes in this version

+ var HistogramIgnoredInAggregationInfo = fmt.Errorf("%w: ignored histogram in", PromQLInfo)

+ func NewHistogramIgnoredInAggregationInfo(aggregation string, pos posrange.PositionRange) error

v0.301.0-rc.1

Dec 30, 2024 GO-2026-5264 +3 more

GO-2026-5264: Prometheus: Remote read endpoint allows denial of service via crafted snappy payload in github.com/prometheus/prometheus

GO-2026-5381: Prometheus vulnerable to stored XSS via crafted histogram bucket label values in the old web UI heatmap display in github.com/prometheus/prometheus

GO-2026-5662: Prometheus has Stored XSS via metric names and label values in Prometheus web UI in github.com/prometheus/prometheus

GO-2026-5710: Prometheus Azure AD remote write OAuth client secret exposed via config API in github.com/prometheus/prometheus

v0.301.0-rc.0

Dec 20, 2024 GO-2026-5264 +3 more

GO-2026-5264: Prometheus: Remote read endpoint allows denial of service via crafted snappy payload in github.com/prometheus/prometheus

GO-2026-5381: Prometheus vulnerable to stored XSS via crafted histogram bucket label values in the old web UI heatmap display in github.com/prometheus/prometheus

GO-2026-5662: Prometheus has Stored XSS via metric names and label values in Prometheus web UI in github.com/prometheus/prometheus

GO-2026-5710: Prometheus Azure AD remote write OAuth client secret exposed via config API in github.com/prometheus/prometheus

v0.300.1

Nov 28, 2024 GO-2026-5264 +3 more

GO-2026-5264: Prometheus: Remote read endpoint allows denial of service via crafted snappy payload in github.com/prometheus/prometheus

GO-2026-5381: Prometheus vulnerable to stored XSS via crafted histogram bucket label values in the old web UI heatmap display in github.com/prometheus/prometheus

GO-2026-5662: Prometheus has Stored XSS via metric names and label values in Prometheus web UI in github.com/prometheus/prometheus

GO-2026-5710: Prometheus Azure AD remote write OAuth client secret exposed via config API in github.com/prometheus/prometheus

v0.300.0

Nov 14, 2024 GO-2026-5264 +3 more

GO-2026-5264: Prometheus: Remote read endpoint allows denial of service via crafted snappy payload in github.com/prometheus/prometheus

GO-2026-5381: Prometheus vulnerable to stored XSS via crafted histogram bucket label values in the old web UI heatmap display in github.com/prometheus/prometheus

GO-2026-5662: Prometheus has Stored XSS via metric names and label values in Prometheus web UI in github.com/prometheus/prometheus

GO-2026-5710: Prometheus Azure AD remote write OAuth client secret exposed via config API in github.com/prometheus/prometheus

Changes in this version

+ var IncompatibleTypesInBinOpInfo = fmt.Errorf("%w: incompatible sample types encountered for binary operator", PromQLInfo)

+ func NewIncompatibleTypesInBinOpInfo(lhsType, operator, rhsType string, pos posrange.PositionRange) error

v0.300.0-rc.1

Nov 11, 2024 GO-2026-5264 +3 more

GO-2026-5264: Prometheus: Remote read endpoint allows denial of service via crafted snappy payload in github.com/prometheus/prometheus

GO-2026-5381: Prometheus vulnerable to stored XSS via crafted histogram bucket label values in the old web UI heatmap display in github.com/prometheus/prometheus

GO-2026-5662: Prometheus has Stored XSS via metric names and label values in Prometheus web UI in github.com/prometheus/prometheus

GO-2026-5710: Prometheus Azure AD remote write OAuth client secret exposed via config API in github.com/prometheus/prometheus

v0.300.0-rc.0

Oct 31, 2024 GO-2026-5264 +3 more

GO-2026-5264: Prometheus: Remote read endpoint allows denial of service via crafted snappy payload in github.com/prometheus/prometheus

GO-2026-5381: Prometheus vulnerable to stored XSS via crafted histogram bucket label values in the old web UI heatmap display in github.com/prometheus/prometheus

GO-2026-5662: Prometheus has Stored XSS via metric names and label values in Prometheus web UI in github.com/prometheus/prometheus

GO-2026-5710: Prometheus Azure AD remote write OAuth client secret exposed via config API in github.com/prometheus/prometheus

v0.300.0-beta.1

Oct 14, 2024 GO-2026-5264 +3 more

GO-2026-5264: Prometheus: Remote read endpoint allows denial of service via crafted snappy payload in github.com/prometheus/prometheus

GO-2026-5381: Prometheus vulnerable to stored XSS via crafted histogram bucket label values in the old web UI heatmap display in github.com/prometheus/prometheus

GO-2026-5662: Prometheus has Stored XSS via metric names and label values in Prometheus web UI in github.com/prometheus/prometheus

GO-2026-5710: Prometheus Azure AD remote write OAuth client secret exposed via config API in github.com/prometheus/prometheus

v0.300.0-beta.0

Sep 10, 2024 GO-2026-5264 +3 more

GO-2026-5264: Prometheus: Remote read endpoint allows denial of service via crafted snappy payload in github.com/prometheus/prometheus

GO-2026-5381: Prometheus vulnerable to stored XSS via crafted histogram bucket label values in the old web UI heatmap display in github.com/prometheus/prometheus

GO-2026-5662: Prometheus has Stored XSS via metric names and label values in Prometheus web UI in github.com/prometheus/prometheus

GO-2026-5710: Prometheus Azure AD remote write OAuth client secret exposed via config API in github.com/prometheus/prometheus

v0.55.1

Nov 4, 2024 GO-2026-5264 +3 more

GO-2026-5264: Prometheus: Remote read endpoint allows denial of service via crafted snappy payload in github.com/prometheus/prometheus

GO-2026-5381: Prometheus vulnerable to stored XSS via crafted histogram bucket label values in the old web UI heatmap display in github.com/prometheus/prometheus

GO-2026-5662: Prometheus has Stored XSS via metric names and label values in Prometheus web UI in github.com/prometheus/prometheus

GO-2026-5710: Prometheus Azure AD remote write OAuth client secret exposed via config API in github.com/prometheus/prometheus

v0.55.0

Oct 22, 2024 GO-2026-5264 +3 more

GO-2026-5264: Prometheus: Remote read endpoint allows denial of service via crafted snappy payload in github.com/prometheus/prometheus

GO-2026-5381: Prometheus vulnerable to stored XSS via crafted histogram bucket label values in the old web UI heatmap display in github.com/prometheus/prometheus

GO-2026-5662: Prometheus has Stored XSS via metric names and label values in Prometheus web UI in github.com/prometheus/prometheus

GO-2026-5710: Prometheus Azure AD remote write OAuth client secret exposed via config API in github.com/prometheus/prometheus

v0.54.1

Aug 27, 2024 GO-2026-5264 +3 more

GO-2026-5264: Prometheus: Remote read endpoint allows denial of service via crafted snappy payload in github.com/prometheus/prometheus

GO-2026-5381: Prometheus vulnerable to stored XSS via crafted histogram bucket label values in the old web UI heatmap display in github.com/prometheus/prometheus

GO-2026-5662: Prometheus has Stored XSS via metric names and label values in Prometheus web UI in github.com/prometheus/prometheus

GO-2026-5710: Prometheus Azure AD remote write OAuth client secret exposed via config API in github.com/prometheus/prometheus

v0.54.0

Aug 9, 2024 GO-2026-5264 +3 more

GO-2026-5264: Prometheus: Remote read endpoint allows denial of service via crafted snappy payload in github.com/prometheus/prometheus

GO-2026-5381: Prometheus vulnerable to stored XSS via crafted histogram bucket label values in the old web UI heatmap display in github.com/prometheus/prometheus

GO-2026-5662: Prometheus has Stored XSS via metric names and label values in Prometheus web UI in github.com/prometheus/prometheus

GO-2026-5710: Prometheus Azure AD remote write OAuth client secret exposed via config API in github.com/prometheus/prometheus

Changes in this version

+ var IncompatibleCustomBucketsHistogramsWarning = fmt.Errorf(...)

+ var InvalidRatioWarning = fmt.Errorf("%w: ratio value should be between -1 and 1", PromQLWarning)

+ var MixedExponentialCustomHistogramsWarning = fmt.Errorf(...)

+ func NewIncompatibleCustomBucketsHistogramsWarning(metricName string, pos posrange.PositionRange) error

+ func NewInvalidRatioWarning(q, to float64, pos posrange.PositionRange) error

+ func NewMixedExponentialCustomHistogramsWarning(metricName string, pos posrange.PositionRange) error

type Annotations

+ func (a Annotations) CountWarningsAndInfo() (countWarnings, countInfo int)

v0.54.0-rc.0

Jul 30, 2024 GO-2026-5264 +3 more

GO-2026-5264: Prometheus: Remote read endpoint allows denial of service via crafted snappy payload in github.com/prometheus/prometheus

GO-2026-5381: Prometheus vulnerable to stored XSS via crafted histogram bucket label values in the old web UI heatmap display in github.com/prometheus/prometheus

GO-2026-5662: Prometheus has Stored XSS via metric names and label values in Prometheus web UI in github.com/prometheus/prometheus

GO-2026-5710: Prometheus Azure AD remote write OAuth client secret exposed via config API in github.com/prometheus/prometheus

v0.53.4

Mar 18, 2025 GO-2026-5264 +3 more

GO-2026-5264: Prometheus: Remote read endpoint allows denial of service via crafted snappy payload in github.com/prometheus/prometheus

GO-2026-5381: Prometheus vulnerable to stored XSS via crafted histogram bucket label values in the old web UI heatmap display in github.com/prometheus/prometheus

GO-2026-5662: Prometheus has Stored XSS via metric names and label values in Prometheus web UI in github.com/prometheus/prometheus

GO-2026-5710: Prometheus Azure AD remote write OAuth client secret exposed via config API in github.com/prometheus/prometheus

v0.53.3

Nov 5, 2024 GO-2026-5264 +3 more

GO-2026-5264: Prometheus: Remote read endpoint allows denial of service via crafted snappy payload in github.com/prometheus/prometheus

GO-2026-5381: Prometheus vulnerable to stored XSS via crafted histogram bucket label values in the old web UI heatmap display in github.com/prometheus/prometheus

GO-2026-5662: Prometheus has Stored XSS via metric names and label values in Prometheus web UI in github.com/prometheus/prometheus

GO-2026-5710: Prometheus Azure AD remote write OAuth client secret exposed via config API in github.com/prometheus/prometheus

v0.53.2

Aug 9, 2024 GO-2026-5264 +3 more

GO-2026-5264: Prometheus: Remote read endpoint allows denial of service via crafted snappy payload in github.com/prometheus/prometheus

GO-2026-5381: Prometheus vulnerable to stored XSS via crafted histogram bucket label values in the old web UI heatmap display in github.com/prometheus/prometheus

GO-2026-5662: Prometheus has Stored XSS via metric names and label values in Prometheus web UI in github.com/prometheus/prometheus

GO-2026-5710: Prometheus Azure AD remote write OAuth client secret exposed via config API in github.com/prometheus/prometheus

v0.53.1

Jul 10, 2024 GO-2026-5264 +3 more

GO-2026-5264: Prometheus: Remote read endpoint allows denial of service via crafted snappy payload in github.com/prometheus/prometheus

GO-2026-5381: Prometheus vulnerable to stored XSS via crafted histogram bucket label values in the old web UI heatmap display in github.com/prometheus/prometheus

GO-2026-5662: Prometheus has Stored XSS via metric names and label values in Prometheus web UI in github.com/prometheus/prometheus

GO-2026-5710: Prometheus Azure AD remote write OAuth client secret exposed via config API in github.com/prometheus/prometheus

v0.53.0

Jun 18, 2024 GO-2026-5264 +3 more

GO-2026-5264: Prometheus: Remote read endpoint allows denial of service via crafted snappy payload in github.com/prometheus/prometheus

GO-2026-5381: Prometheus vulnerable to stored XSS via crafted histogram bucket label values in the old web UI heatmap display in github.com/prometheus/prometheus

GO-2026-5662: Prometheus has Stored XSS via metric names and label values in Prometheus web UI in github.com/prometheus/prometheus

GO-2026-5710: Prometheus Azure AD remote write OAuth client secret exposed via config API in github.com/prometheus/prometheus

v0.53.0-rc.1

Jun 11, 2024 GO-2026-5264 +3 more

GO-2026-5264: Prometheus: Remote read endpoint allows denial of service via crafted snappy payload in github.com/prometheus/prometheus

GO-2026-5381: Prometheus vulnerable to stored XSS via crafted histogram bucket label values in the old web UI heatmap display in github.com/prometheus/prometheus

GO-2026-5662: Prometheus has Stored XSS via metric names and label values in Prometheus web UI in github.com/prometheus/prometheus

GO-2026-5710: Prometheus Azure AD remote write OAuth client secret exposed via config API in github.com/prometheus/prometheus

v0.53.0-rc.0

Jun 7, 2024 GO-2026-5264 +3 more

GO-2026-5264: Prometheus: Remote read endpoint allows denial of service via crafted snappy payload in github.com/prometheus/prometheus

GO-2026-5381: Prometheus vulnerable to stored XSS via crafted histogram bucket label values in the old web UI heatmap display in github.com/prometheus/prometheus

GO-2026-5662: Prometheus has Stored XSS via metric names and label values in Prometheus web UI in github.com/prometheus/prometheus

GO-2026-5710: Prometheus Azure AD remote write OAuth client secret exposed via config API in github.com/prometheus/prometheus

v0.52.1

May 30, 2024 GO-2026-5264 +3 more

GO-2026-5264: Prometheus: Remote read endpoint allows denial of service via crafted snappy payload in github.com/prometheus/prometheus

GO-2026-5381: Prometheus vulnerable to stored XSS via crafted histogram bucket label values in the old web UI heatmap display in github.com/prometheus/prometheus

GO-2026-5662: Prometheus has Stored XSS via metric names and label values in Prometheus web UI in github.com/prometheus/prometheus

GO-2026-5710: Prometheus Azure AD remote write OAuth client secret exposed via config API in github.com/prometheus/prometheus

v0.52.0

May 8, 2024 GO-2026-5264 +3 more

GO-2026-5264: Prometheus: Remote read endpoint allows denial of service via crafted snappy payload in github.com/prometheus/prometheus

GO-2026-5381: Prometheus vulnerable to stored XSS via crafted histogram bucket label values in the old web UI heatmap display in github.com/prometheus/prometheus

GO-2026-5662: Prometheus has Stored XSS via metric names and label values in Prometheus web UI in github.com/prometheus/prometheus

GO-2026-5710: Prometheus Azure AD remote write OAuth client secret exposed via config API in github.com/prometheus/prometheus

v0.52.0-rc.1

May 3, 2024 GO-2026-5264 +3 more

GO-2026-5264: Prometheus: Remote read endpoint allows denial of service via crafted snappy payload in github.com/prometheus/prometheus

GO-2026-5381: Prometheus vulnerable to stored XSS via crafted histogram bucket label values in the old web UI heatmap display in github.com/prometheus/prometheus

GO-2026-5662: Prometheus has Stored XSS via metric names and label values in Prometheus web UI in github.com/prometheus/prometheus

GO-2026-5710: Prometheus Azure AD remote write OAuth client secret exposed via config API in github.com/prometheus/prometheus

v0.52.0-rc.0

Apr 30, 2024 GO-2026-5264 +3 more

GO-2026-5264: Prometheus: Remote read endpoint allows denial of service via crafted snappy payload in github.com/prometheus/prometheus

GO-2026-5381: Prometheus vulnerable to stored XSS via crafted histogram bucket label values in the old web UI heatmap display in github.com/prometheus/prometheus

GO-2026-5662: Prometheus has Stored XSS via metric names and label values in Prometheus web UI in github.com/prometheus/prometheus

GO-2026-5710: Prometheus Azure AD remote write OAuth client secret exposed via config API in github.com/prometheus/prometheus

v0.51.2

Apr 10, 2024 GO-2026-5264 +3 more

GO-2026-5264: Prometheus: Remote read endpoint allows denial of service via crafted snappy payload in github.com/prometheus/prometheus

GO-2026-5381: Prometheus vulnerable to stored XSS via crafted histogram bucket label values in the old web UI heatmap display in github.com/prometheus/prometheus

GO-2026-5662: Prometheus has Stored XSS via metric names and label values in Prometheus web UI in github.com/prometheus/prometheus

GO-2026-5710: Prometheus Azure AD remote write OAuth client secret exposed via config API in github.com/prometheus/prometheus

v0.51.1

Mar 28, 2024 GO-2026-5264 +3 more

GO-2026-5264: Prometheus: Remote read endpoint allows denial of service via crafted snappy payload in github.com/prometheus/prometheus

GO-2026-5381: Prometheus vulnerable to stored XSS via crafted histogram bucket label values in the old web UI heatmap display in github.com/prometheus/prometheus

GO-2026-5662: Prometheus has Stored XSS via metric names and label values in Prometheus web UI in github.com/prometheus/prometheus

GO-2026-5710: Prometheus Azure AD remote write OAuth client secret exposed via config API in github.com/prometheus/prometheus

v0.51.0

Mar 19, 2024 GO-2026-5264 +3 more

GO-2026-5264: Prometheus: Remote read endpoint allows denial of service via crafted snappy payload in github.com/prometheus/prometheus

GO-2026-5381: Prometheus vulnerable to stored XSS via crafted histogram bucket label values in the old web UI heatmap display in github.com/prometheus/prometheus

GO-2026-5662: Prometheus has Stored XSS via metric names and label values in Prometheus web UI in github.com/prometheus/prometheus

GO-2026-5710: Prometheus Azure AD remote write OAuth client secret exposed via config API in github.com/prometheus/prometheus

Changes in this version

+ func NewMixedFloatsHistogramsAggWarning(pos posrange.PositionRange) error

v0.50.1

Feb 26, 2024 GO-2026-5264 +3 more

GO-2026-5264: Prometheus: Remote read endpoint allows denial of service via crafted snappy payload in github.com/prometheus/prometheus

GO-2026-5381: Prometheus vulnerable to stored XSS via crafted histogram bucket label values in the old web UI heatmap display in github.com/prometheus/prometheus

GO-2026-5662: Prometheus has Stored XSS via metric names and label values in Prometheus web UI in github.com/prometheus/prometheus

GO-2026-5710: Prometheus Azure AD remote write OAuth client secret exposed via config API in github.com/prometheus/prometheus

v0.50.0

Feb 22, 2024 GO-2026-5264 +3 more

GO-2026-5264: Prometheus: Remote read endpoint allows denial of service via crafted snappy payload in github.com/prometheus/prometheus

GO-2026-5381: Prometheus vulnerable to stored XSS via crafted histogram bucket label values in the old web UI heatmap display in github.com/prometheus/prometheus

GO-2026-5662: Prometheus has Stored XSS via metric names and label values in Prometheus web UI in github.com/prometheus/prometheus

GO-2026-5710: Prometheus Azure AD remote write OAuth client secret exposed via config API in github.com/prometheus/prometheus

Changes in this version

+ var NativeHistogramNotCounterWarning = fmt.Errorf("%w: this native histogram metric is not a counter:", PromQLWarning)

+ var NativeHistogramNotGaugeWarning = fmt.Errorf("%w: this native histogram metric is not a gauge:", PromQLWarning)

+ func NewNativeHistogramNotCounterWarning(metricName string, pos posrange.PositionRange) error

+ func NewNativeHistogramNotGaugeWarning(metricName string, pos posrange.PositionRange) error

v0.50.0-rc.1

Feb 19, 2024 GO-2026-5264 +3 more

GO-2026-5264: Prometheus: Remote read endpoint allows denial of service via crafted snappy payload in github.com/prometheus/prometheus

GO-2026-5381: Prometheus vulnerable to stored XSS via crafted histogram bucket label values in the old web UI heatmap display in github.com/prometheus/prometheus

GO-2026-5662: Prometheus has Stored XSS via metric names and label values in Prometheus web UI in github.com/prometheus/prometheus

GO-2026-5710: Prometheus Azure AD remote write OAuth client secret exposed via config API in github.com/prometheus/prometheus

v0.50.0-rc.0

Feb 13, 2024 GO-2026-5264 +3 more

GO-2026-5264: Prometheus: Remote read endpoint allows denial of service via crafted snappy payload in github.com/prometheus/prometheus

GO-2026-5381: Prometheus vulnerable to stored XSS via crafted histogram bucket label values in the old web UI heatmap display in github.com/prometheus/prometheus

GO-2026-5662: Prometheus has Stored XSS via metric names and label values in Prometheus web UI in github.com/prometheus/prometheus

GO-2026-5710: Prometheus Azure AD remote write OAuth client secret exposed via config API in github.com/prometheus/prometheus

v0.49.1

Jan 15, 2024 GO-2026-5264 +3 more

GO-2026-5264: Prometheus: Remote read endpoint allows denial of service via crafted snappy payload in github.com/prometheus/prometheus

GO-2026-5381: Prometheus vulnerable to stored XSS via crafted histogram bucket label values in the old web UI heatmap display in github.com/prometheus/prometheus

GO-2026-5662: Prometheus has Stored XSS via metric names and label values in Prometheus web UI in github.com/prometheus/prometheus

GO-2026-5710: Prometheus Azure AD remote write OAuth client secret exposed via config API in github.com/prometheus/prometheus

v0.49.0

Jan 15, 2024 GO-2026-5264 +3 more

GO-2026-5264: Prometheus: Remote read endpoint allows denial of service via crafted snappy payload in github.com/prometheus/prometheus

GO-2026-5381: Prometheus vulnerable to stored XSS via crafted histogram bucket label values in the old web UI heatmap display in github.com/prometheus/prometheus

GO-2026-5662: Prometheus has Stored XSS via metric names and label values in Prometheus web UI in github.com/prometheus/prometheus

GO-2026-5710: Prometheus Azure AD remote write OAuth client secret exposed via config API in github.com/prometheus/prometheus

v0.49.0-rc.2

Jan 8, 2024 GO-2026-5264 +3 more

GO-2026-5264: Prometheus: Remote read endpoint allows denial of service via crafted snappy payload in github.com/prometheus/prometheus

GO-2026-5381: Prometheus vulnerable to stored XSS via crafted histogram bucket label values in the old web UI heatmap display in github.com/prometheus/prometheus

GO-2026-5662: Prometheus has Stored XSS via metric names and label values in Prometheus web UI in github.com/prometheus/prometheus

GO-2026-5710: Prometheus Azure AD remote write OAuth client secret exposed via config API in github.com/prometheus/prometheus

v0.49.0-rc.1

Dec 20, 2023 GO-2026-5264 +3 more

GO-2026-5264: Prometheus: Remote read endpoint allows denial of service via crafted snappy payload in github.com/prometheus/prometheus

GO-2026-5381: Prometheus vulnerable to stored XSS via crafted histogram bucket label values in the old web UI heatmap display in github.com/prometheus/prometheus

GO-2026-5662: Prometheus has Stored XSS via metric names and label values in Prometheus web UI in github.com/prometheus/prometheus

GO-2026-5710: Prometheus Azure AD remote write OAuth client secret exposed via config API in github.com/prometheus/prometheus

v0.49.0-rc.0

Dec 12, 2023 GO-2026-5264 +3 more

GO-2026-5264: Prometheus: Remote read endpoint allows denial of service via crafted snappy payload in github.com/prometheus/prometheus

GO-2026-5381: Prometheus vulnerable to stored XSS via crafted histogram bucket label values in the old web UI heatmap display in github.com/prometheus/prometheus

GO-2026-5662: Prometheus has Stored XSS via metric names and label values in Prometheus web UI in github.com/prometheus/prometheus

GO-2026-5710: Prometheus Azure AD remote write OAuth client secret exposed via config API in github.com/prometheus/prometheus

v0.48.1

Dec 8, 2023 GO-2026-5264 +3 more

GO-2026-5264: Prometheus: Remote read endpoint allows denial of service via crafted snappy payload in github.com/prometheus/prometheus

GO-2026-5381: Prometheus vulnerable to stored XSS via crafted histogram bucket label values in the old web UI heatmap display in github.com/prometheus/prometheus

GO-2026-5662: Prometheus has Stored XSS via metric names and label values in Prometheus web UI in github.com/prometheus/prometheus

GO-2026-5710: Prometheus Azure AD remote write OAuth client secret exposed via config API in github.com/prometheus/prometheus

v0.48.0

Nov 15, 2023 GO-2026-5264 +3 more

GO-2026-5264: Prometheus: Remote read endpoint allows denial of service via crafted snappy payload in github.com/prometheus/prometheus

GO-2026-5381: Prometheus vulnerable to stored XSS via crafted histogram bucket label values in the old web UI heatmap display in github.com/prometheus/prometheus

GO-2026-5662: Prometheus has Stored XSS via metric names and label values in Prometheus web UI in github.com/prometheus/prometheus

GO-2026-5710: Prometheus Azure AD remote write OAuth client secret exposed via config API in github.com/prometheus/prometheus

Changes in this version

+ var BadBucketLabelWarning = fmt.Errorf("%w: bucket label %q is missing or has a malformed value", PromQLWarning, ...)

+ var HistogramQuantileForcedMonotonicityInfo = fmt.Errorf(...)

+ var InvalidQuantileWarning = fmt.Errorf("%w: quantile value should be between 0 and 1", PromQLWarning)

+ var MixedClassicNativeHistogramsWarning = fmt.Errorf("%w: vector contains a mix of classic and native histograms for metric name", ...)

+ var MixedFloatsHistogramsWarning = fmt.Errorf("%w: encountered a mix of histograms and floats for metric name", ...)

+ var PossibleNonCounterInfo = fmt.Errorf(...)

+ var PromQLInfo = errors.New("PromQL info")

+ var PromQLWarning = errors.New("PromQL warning")

+ func NewBadBucketLabelWarning(metricName, label string, pos posrange.PositionRange) annoErr

+ func NewHistogramQuantileForcedMonotonicityInfo(metricName string, pos posrange.PositionRange) annoErr

+ func NewInvalidQuantileWarning(q float64, pos posrange.PositionRange) annoErr

+ func NewMixedClassicNativeHistogramsWarning(metricName string, pos posrange.PositionRange) annoErr

+ func NewMixedFloatsHistogramsWarning(metricName string, pos posrange.PositionRange) annoErr

+ func NewPossibleNonCounterInfo(metricName string, pos posrange.PositionRange) annoErr

+ type Annotations map[string]error

+ func New() *Annotations

+ func (a *Annotations) Add(err error) Annotations

+ func (a *Annotations) Merge(aa Annotations) Annotations

+ func (a Annotations) AsErrors() []error

+ func (a Annotations) AsStrings(query string, maxAnnos int) []string

v0.48.0-rc.2

Nov 2, 2023 GO-2026-5264 +3 more

GO-2026-5264: Prometheus: Remote read endpoint allows denial of service via crafted snappy payload in github.com/prometheus/prometheus

GO-2026-5381: Prometheus vulnerable to stored XSS via crafted histogram bucket label values in the old web UI heatmap display in github.com/prometheus/prometheus

GO-2026-5662: Prometheus has Stored XSS via metric names and label values in Prometheus web UI in github.com/prometheus/prometheus

GO-2026-5710: Prometheus Azure AD remote write OAuth client secret exposed via config API in github.com/prometheus/prometheus

v0.48.0-rc.1

Oct 27, 2023 GO-2026-5264 +3 more

GO-2026-5264: Prometheus: Remote read endpoint allows denial of service via crafted snappy payload in github.com/prometheus/prometheus

GO-2026-5381: Prometheus vulnerable to stored XSS via crafted histogram bucket label values in the old web UI heatmap display in github.com/prometheus/prometheus

GO-2026-5662: Prometheus has Stored XSS via metric names and label values in Prometheus web UI in github.com/prometheus/prometheus

GO-2026-5710: Prometheus Azure AD remote write OAuth client secret exposed via config API in github.com/prometheus/prometheus

v0.48.0-rc.0

Oct 17, 2023 GO-2026-5264 +3 more

GO-2026-5264: Prometheus: Remote read endpoint allows denial of service via crafted snappy payload in github.com/prometheus/prometheus

GO-2026-5381: Prometheus vulnerable to stored XSS via crafted histogram bucket label values in the old web UI heatmap display in github.com/prometheus/prometheus

GO-2026-5662: Prometheus has Stored XSS via metric names and label values in Prometheus web UI in github.com/prometheus/prometheus

GO-2026-5710: Prometheus Azure AD remote write OAuth client secret exposed via config API in github.com/prometheus/prometheus

?	: This menu
/	: Search site
f or F	: Jump to
y or Y	: Canonical URL