tsdb

Jul 1, 2026

Changes in this version

type HeadOptions

+ FloatChunkEncoding atomic.Uint32

+ func (o *HeadOptions) UseXOR2FloatEncoding() bool

type Options

+ FloatChunkEncoding chunkenc.Encoding

May 28, 2026

Changes in this version

type HeadAndOOOChunkReader

+ func (cr *HeadAndOOOChunkReader) EnableChunkCache()

type HeadAndOOOQuerier

+ func (q *HeadAndOOOQuerier) SearchLabelNames(ctx context.Context, hints *storage.SearchHints, matchers ...*labels.Matcher) storage.SearchResultSet

+ func (q *HeadAndOOOQuerier) SearchLabelValues(ctx context.Context, name string, hints *storage.SearchHints, ...) storage.SearchResultSet

Apr 13, 2026 GO-2026-5264 +2 more

  GO-2026-5264: Prometheus: Remote read endpoint allows denial of service via crafted snappy payload in github.com/prometheus/prometheus

  GO-2026-5381: Prometheus vulnerable to stored XSS via crafted histogram bucket label values in the old web UI heatmap display in github.com/prometheus/prometheus

  GO-2026-5710: Prometheus Azure AD remote write OAuth client secret exposed via config API in github.com/prometheus/prometheus

Apr 7, 2026 GO-2026-5264 +3 more

  GO-2026-5264: Prometheus: Remote read endpoint allows denial of service via crafted snappy payload in github.com/prometheus/prometheus

  GO-2026-5381: Prometheus vulnerable to stored XSS via crafted histogram bucket label values in the old web UI heatmap display in github.com/prometheus/prometheus

  GO-2026-5662: Prometheus has Stored XSS via metric names and label values in Prometheus web UI in github.com/prometheus/prometheus

  GO-2026-5710: Prometheus Azure AD remote write OAuth client secret exposed via config API in github.com/prometheus/prometheus

Apr 2, 2026 GO-2026-5264 +3 more

  GO-2026-5264: Prometheus: Remote read endpoint allows denial of service via crafted snappy payload in github.com/prometheus/prometheus

  GO-2026-5381: Prometheus vulnerable to stored XSS via crafted histogram bucket label values in the old web UI heatmap display in github.com/prometheus/prometheus

  GO-2026-5662: Prometheus has Stored XSS via metric names and label values in Prometheus web UI in github.com/prometheus/prometheus

  GO-2026-5710: Prometheus Azure AD remote write OAuth client secret exposed via config API in github.com/prometheus/prometheus

Changes in this version

+ type FsSizeFunc func(path string) uint64

type HeadOptions

+ EnableFastStartup bool

+ EnableSTStorage atomic.Bool

+ EnableXOR2Encoding atomic.Bool

type Options

+ EnableFastStartup bool

+ EnableXOR2Encoding bool

+ FsSizeFunc FsSizeFunc

+ MaxPercentage float64

+ type SeriesLifecycleState struct

+ CleanShutdown bool

+ LastSeriesID uint64

+ LastWALSegment int

Feb 25, 2026 GO-2026-5264 +3 more

  GO-2026-5264: Prometheus: Remote read endpoint allows denial of service via crafted snappy payload in github.com/prometheus/prometheus

  GO-2026-5381: Prometheus vulnerable to stored XSS via crafted histogram bucket label values in the old web UI heatmap display in github.com/prometheus/prometheus

  GO-2026-5662: Prometheus has Stored XSS via metric names and label values in Prometheus web UI in github.com/prometheus/prometheus

  GO-2026-5710: Prometheus Azure AD remote write OAuth client secret exposed via config API in github.com/prometheus/prometheus

Changes in this version

+ const CompactionHintFromStaleSeries

type BlockMetaCompaction

+ func (bm *BlockMetaCompaction) FromStaleSeries() bool

+ func (bm *BlockMetaCompaction) SetStaleSeries()

type CircularExemplarStorage

+ func (ce *CircularExemplarStorage) SetOutOfOrderTimeWindow(d int64)

type DB

+ func (db *DB) CompactStaleHead() (err error)

type DeletedIterator

+ func (it *DeletedIterator) AtST() int64

type Head

+ func (h *Head) SortedStaleSeriesRefsNoOOOData(ctx context.Context) ([]storage.SeriesRef, error)

type Options

+ EnableSTStorage bool

+ StaleSeriesCompactionThreshold float64

+ type StaleHead struct

+ func NewStaleHead(head *Head, mint, maxt int64, staleSeriesRefs []storage.SeriesRef) *StaleHead

+ func (h *StaleHead) Index() (_ IndexReader, err error)

+ func (h *StaleHead) Meta() BlockMeta

+ func (h *StaleHead) NumSeries() uint64

+ func (h *StaleHead) String() string

Feb 19, 2026 GO-2026-5264 +3 more

  GO-2026-5264: Prometheus: Remote read endpoint allows denial of service via crafted snappy payload in github.com/prometheus/prometheus

  GO-2026-5381: Prometheus vulnerable to stored XSS via crafted histogram bucket label values in the old web UI heatmap display in github.com/prometheus/prometheus

  GO-2026-5662: Prometheus has Stored XSS via metric names and label values in Prometheus web UI in github.com/prometheus/prometheus

  GO-2026-5710: Prometheus Azure AD remote write OAuth client secret exposed via config API in github.com/prometheus/prometheus

Feb 17, 2026 GO-2026-5264 +3 more

  GO-2026-5264: Prometheus: Remote read endpoint allows denial of service via crafted snappy payload in github.com/prometheus/prometheus

  GO-2026-5381: Prometheus vulnerable to stored XSS via crafted histogram bucket label values in the old web UI heatmap display in github.com/prometheus/prometheus

  GO-2026-5662: Prometheus has Stored XSS via metric names and label values in Prometheus web UI in github.com/prometheus/prometheus

  GO-2026-5710: Prometheus Azure AD remote write OAuth client secret exposed via config API in github.com/prometheus/prometheus

Jan 7, 2026 GO-2026-5264 +3 more

  GO-2026-5264: Prometheus: Remote read endpoint allows denial of service via crafted snappy payload in github.com/prometheus/prometheus

  GO-2026-5381: Prometheus vulnerable to stored XSS via crafted histogram bucket label values in the old web UI heatmap display in github.com/prometheus/prometheus

  GO-2026-5662: Prometheus has Stored XSS via metric names and label values in Prometheus web UI in github.com/prometheus/prometheus

  GO-2026-5710: Prometheus Azure AD remote write OAuth client secret exposed via config API in github.com/prometheus/prometheus

Jan 6, 2026 GO-2026-5264 +3 more

  GO-2026-5264: Prometheus: Remote read endpoint allows denial of service via crafted snappy payload in github.com/prometheus/prometheus

  GO-2026-5381: Prometheus vulnerable to stored XSS via crafted histogram bucket label values in the old web UI heatmap display in github.com/prometheus/prometheus

  GO-2026-5662: Prometheus has Stored XSS via metric names and label values in Prometheus web UI in github.com/prometheus/prometheus

  GO-2026-5710: Prometheus Azure AD remote write OAuth client secret exposed via config API in github.com/prometheus/prometheus

Changes in this version

+ type BlockExcludeFilterFunc func(meta *BlockMeta) bool

type BlockWriter

+ func (w *BlockWriter) AppenderV2(ctx context.Context) storage.AppenderV2

type DB

+ func (db *DB) AppenderV2(ctx context.Context) storage.AppenderV2

type Head

+ func (h *Head) AppenderV2(context.Context) storage.AppenderV2

type HeadOptions

+ EnableMetadataWALRecords bool

+ EnableSTAsZeroSample bool

type LeveledCompactorOptions

+ BlockExcludeFilter BlockExcludeFilterFunc

type Options

+ BlockCompactionExcludeFunc BlockExcludeFilterFunc

+ BlockReloadInterval time.Duration

+ EnableMetadataWALRecords bool

+ EnableSTAsZeroSample bool

+ FeatureRegistry features.Collector

Dec 16, 2025 GO-2026-5264 +3 more

  GO-2026-5264: Prometheus: Remote read endpoint allows denial of service via crafted snappy payload in github.com/prometheus/prometheus

  GO-2026-5381: Prometheus vulnerable to stored XSS via crafted histogram bucket label values in the old web UI heatmap display in github.com/prometheus/prometheus

  GO-2026-5662: Prometheus has Stored XSS via metric names and label values in Prometheus web UI in github.com/prometheus/prometheus

  GO-2026-5710: Prometheus Azure AD remote write OAuth client secret exposed via config API in github.com/prometheus/prometheus

Dec 2, 2025 GO-2026-5264 +3 more

  GO-2026-5264: Prometheus: Remote read endpoint allows denial of service via crafted snappy payload in github.com/prometheus/prometheus

  GO-2026-5381: Prometheus vulnerable to stored XSS via crafted histogram bucket label values in the old web UI heatmap display in github.com/prometheus/prometheus

  GO-2026-5662: Prometheus has Stored XSS via metric names and label values in Prometheus web UI in github.com/prometheus/prometheus

  GO-2026-5710: Prometheus Azure AD remote write OAuth client secret exposed via config API in github.com/prometheus/prometheus

Nov 24, 2025 GO-2026-5264 +3 more

  GO-2026-5264: Prometheus: Remote read endpoint allows denial of service via crafted snappy payload in github.com/prometheus/prometheus

  GO-2026-5381: Prometheus vulnerable to stored XSS via crafted histogram bucket label values in the old web UI heatmap display in github.com/prometheus/prometheus

  GO-2026-5662: Prometheus has Stored XSS via metric names and label values in Prometheus web UI in github.com/prometheus/prometheus

  GO-2026-5710: Prometheus Azure AD remote write OAuth client secret exposed via config API in github.com/prometheus/prometheus

Nov 14, 2025 GO-2026-5264 +3 more

  GO-2026-5264: Prometheus: Remote read endpoint allows denial of service via crafted snappy payload in github.com/prometheus/prometheus

  GO-2026-5381: Prometheus vulnerable to stored XSS via crafted histogram bucket label values in the old web UI heatmap display in github.com/prometheus/prometheus

  GO-2026-5662: Prometheus has Stored XSS via metric names and label values in Prometheus web UI in github.com/prometheus/prometheus

  GO-2026-5710: Prometheus Azure AD remote write OAuth client secret exposed via config API in github.com/prometheus/prometheus

Oct 30, 2025 GO-2026-5264 +3 more

  GO-2026-5264: Prometheus: Remote read endpoint allows denial of service via crafted snappy payload in github.com/prometheus/prometheus

  GO-2026-5381: Prometheus vulnerable to stored XSS via crafted histogram bucket label values in the old web UI heatmap display in github.com/prometheus/prometheus

  GO-2026-5662: Prometheus has Stored XSS via metric names and label values in Prometheus web UI in github.com/prometheus/prometheus

  GO-2026-5710: Prometheus Azure AD remote write OAuth client secret exposed via config API in github.com/prometheus/prometheus

Oct 22, 2025 GO-2026-5264 +3 more

  GO-2026-5264: Prometheus: Remote read endpoint allows denial of service via crafted snappy payload in github.com/prometheus/prometheus

  GO-2026-5381: Prometheus vulnerable to stored XSS via crafted histogram bucket label values in the old web UI heatmap display in github.com/prometheus/prometheus

  GO-2026-5662: Prometheus has Stored XSS via metric names and label values in Prometheus web UI in github.com/prometheus/prometheus

  GO-2026-5710: Prometheus Azure AD remote write OAuth client secret exposed via config API in github.com/prometheus/prometheus

Oct 17, 2025 GO-2026-5264 +3 more

  GO-2026-5264: Prometheus: Remote read endpoint allows denial of service via crafted snappy payload in github.com/prometheus/prometheus

  GO-2026-5381: Prometheus vulnerable to stored XSS via crafted histogram bucket label values in the old web UI heatmap display in github.com/prometheus/prometheus

  GO-2026-5662: Prometheus has Stored XSS via metric names and label values in Prometheus web UI in github.com/prometheus/prometheus

  GO-2026-5710: Prometheus Azure AD remote write OAuth client secret exposed via config API in github.com/prometheus/prometheus

Oct 15, 2025 GO-2026-5264 +3 more

  GO-2026-5264: Prometheus: Remote read endpoint allows denial of service via crafted snappy payload in github.com/prometheus/prometheus

  GO-2026-5381: Prometheus vulnerable to stored XSS via crafted histogram bucket label values in the old web UI heatmap display in github.com/prometheus/prometheus

  GO-2026-5662: Prometheus has Stored XSS via metric names and label values in Prometheus web UI in github.com/prometheus/prometheus

  GO-2026-5710: Prometheus Azure AD remote write OAuth client secret exposed via config API in github.com/prometheus/prometheus

Oct 8, 2025 GO-2026-5264 +3 more

  GO-2026-5264: Prometheus: Remote read endpoint allows denial of service via crafted snappy payload in github.com/prometheus/prometheus

  GO-2026-5381: Prometheus vulnerable to stored XSS via crafted histogram bucket label values in the old web UI heatmap display in github.com/prometheus/prometheus

  GO-2026-5662: Prometheus has Stored XSS via metric names and label values in Prometheus web UI in github.com/prometheus/prometheus

  GO-2026-5710: Prometheus Azure AD remote write OAuth client secret exposed via config API in github.com/prometheus/prometheus

Sep 17, 2025 GO-2026-5264 +3 more

  GO-2026-5264: Prometheus: Remote read endpoint allows denial of service via crafted snappy payload in github.com/prometheus/prometheus

  GO-2026-5381: Prometheus vulnerable to stored XSS via crafted histogram bucket label values in the old web UI heatmap display in github.com/prometheus/prometheus

  GO-2026-5662: Prometheus has Stored XSS via metric names and label values in Prometheus web UI in github.com/prometheus/prometheus

  GO-2026-5710: Prometheus Azure AD remote write OAuth client secret exposed via config API in github.com/prometheus/prometheus

Changes in this version

type BlockStats

+ NumFloatSamples uint64

+ NumHistogramSamples uint64

type DB

+ func (db *DB) BlockMetas() []BlockMeta

type Head

+ func (h *Head) NumStaleSeries() uint64

Sep 10, 2025 GO-2026-5381 +2 more

  GO-2026-5381: Prometheus vulnerable to stored XSS via crafted histogram bucket label values in the old web UI heatmap display in github.com/prometheus/prometheus

  GO-2026-5662: Prometheus has Stored XSS via metric names and label values in Prometheus web UI in github.com/prometheus/prometheus

  GO-2026-5710: Prometheus Azure AD remote write OAuth client secret exposed via config API in github.com/prometheus/prometheus

Aug 21, 2025 GO-2026-5381 +2 more

  GO-2026-5381: Prometheus vulnerable to stored XSS via crafted histogram bucket label values in the old web UI heatmap display in github.com/prometheus/prometheus

  GO-2026-5662: Prometheus has Stored XSS via metric names and label values in Prometheus web UI in github.com/prometheus/prometheus

  GO-2026-5710: Prometheus Azure AD remote write OAuth client secret exposed via config API in github.com/prometheus/prometheus

Jul 8, 2026 GO-2026-5381 +2 more

  GO-2026-5381: Prometheus vulnerable to stored XSS via crafted histogram bucket label values in the old web UI heatmap display in github.com/prometheus/prometheus

  GO-2026-5662: Prometheus has Stored XSS via metric names and label values in Prometheus web UI in github.com/prometheus/prometheus

  GO-2026-5710: Prometheus Azure AD remote write OAuth client secret exposed via config API in github.com/prometheus/prometheus

Jun 17, 2026 GO-2026-5381 +2 more

  GO-2026-5381: Prometheus vulnerable to stored XSS via crafted histogram bucket label values in the old web UI heatmap display in github.com/prometheus/prometheus

  GO-2026-5662: Prometheus has Stored XSS via metric names and label values in Prometheus web UI in github.com/prometheus/prometheus

  GO-2026-5710: Prometheus Azure AD remote write OAuth client secret exposed via config API in github.com/prometheus/prometheus

Apr 27, 2026 GO-2026-5381 +2 more

  GO-2026-5381: Prometheus vulnerable to stored XSS via crafted histogram bucket label values in the old web UI heatmap display in github.com/prometheus/prometheus

  GO-2026-5662: Prometheus has Stored XSS via metric names and label values in Prometheus web UI in github.com/prometheus/prometheus

  GO-2026-5710: Prometheus Azure AD remote write OAuth client secret exposed via config API in github.com/prometheus/prometheus

Apr 13, 2026 GO-2026-5381 +2 more

  GO-2026-5381: Prometheus vulnerable to stored XSS via crafted histogram bucket label values in the old web UI heatmap display in github.com/prometheus/prometheus

  GO-2026-5662: Prometheus has Stored XSS via metric names and label values in Prometheus web UI in github.com/prometheus/prometheus

  GO-2026-5710: Prometheus Azure AD remote write OAuth client secret exposed via config API in github.com/prometheus/prometheus

Jan 21, 2026 GO-2026-5264 +3 more

  GO-2026-5264: Prometheus: Remote read endpoint allows denial of service via crafted snappy payload in github.com/prometheus/prometheus

  GO-2026-5381: Prometheus vulnerable to stored XSS via crafted histogram bucket label values in the old web UI heatmap display in github.com/prometheus/prometheus

  GO-2026-5662: Prometheus has Stored XSS via metric names and label values in Prometheus web UI in github.com/prometheus/prometheus

  GO-2026-5710: Prometheus Azure AD remote write OAuth client secret exposed via config API in github.com/prometheus/prometheus

Jul 14, 2025 GO-2026-5264 +3 more

  GO-2026-5264: Prometheus: Remote read endpoint allows denial of service via crafted snappy payload in github.com/prometheus/prometheus

  GO-2026-5381: Prometheus vulnerable to stored XSS via crafted histogram bucket label values in the old web UI heatmap display in github.com/prometheus/prometheus

  GO-2026-5662: Prometheus has Stored XSS via metric names and label values in Prometheus web UI in github.com/prometheus/prometheus

  GO-2026-5710: Prometheus Azure AD remote write OAuth client secret exposed via config API in github.com/prometheus/prometheus

Changes in this version

type LeveledCompactorOptions

+ UseUncachedIO bool

type Options

+ UseUncachedIO bool

Jun 26, 2025 GO-2026-5264 +3 more

  GO-2026-5264: Prometheus: Remote read endpoint allows denial of service via crafted snappy payload in github.com/prometheus/prometheus

  GO-2026-5381: Prometheus vulnerable to stored XSS via crafted histogram bucket label values in the old web UI heatmap display in github.com/prometheus/prometheus

  GO-2026-5662: Prometheus has Stored XSS via metric names and label values in Prometheus web UI in github.com/prometheus/prometheus

  GO-2026-5710: Prometheus Azure AD remote write OAuth client secret exposed via config API in github.com/prometheus/prometheus

May 31, 2025 GO-2026-5264 +3 more

  GO-2026-5264: Prometheus: Remote read endpoint allows denial of service via crafted snappy payload in github.com/prometheus/prometheus

  GO-2026-5381: Prometheus vulnerable to stored XSS via crafted histogram bucket label values in the old web UI heatmap display in github.com/prometheus/prometheus

  GO-2026-5662: Prometheus has Stored XSS via metric names and label values in Prometheus web UI in github.com/prometheus/prometheus

  GO-2026-5710: Prometheus Azure AD remote write OAuth client secret exposed via config API in github.com/prometheus/prometheus

May 17, 2025 GO-2026-5264 +3 more

  GO-2026-5264: Prometheus: Remote read endpoint allows denial of service via crafted snappy payload in github.com/prometheus/prometheus

  GO-2026-5381: Prometheus vulnerable to stored XSS via crafted histogram bucket label values in the old web UI heatmap display in github.com/prometheus/prometheus

  GO-2026-5662: Prometheus has Stored XSS via metric names and label values in Prometheus web UI in github.com/prometheus/prometheus

  GO-2026-5710: Prometheus Azure AD remote write OAuth client secret exposed via config API in github.com/prometheus/prometheus

Changes in this version

type LeveledCompactorOptions

+ Metrics *CompactorMetrics

May 2, 2025 GO-2026-5264 +3 more

  GO-2026-5264: Prometheus: Remote read endpoint allows denial of service via crafted snappy payload in github.com/prometheus/prometheus

  GO-2026-5381: Prometheus vulnerable to stored XSS via crafted histogram bucket label values in the old web UI heatmap display in github.com/prometheus/prometheus

  GO-2026-5662: Prometheus has Stored XSS via metric names and label values in Prometheus web UI in github.com/prometheus/prometheus

  GO-2026-5710: Prometheus Azure AD remote write OAuth client secret exposed via config API in github.com/prometheus/prometheus

May 2, 2025 GO-2026-5264 +3 more

  GO-2026-5264: Prometheus: Remote read endpoint allows denial of service via crafted snappy payload in github.com/prometheus/prometheus

  GO-2026-5381: Prometheus vulnerable to stored XSS via crafted histogram bucket label values in the old web UI heatmap display in github.com/prometheus/prometheus

  GO-2026-5662: Prometheus has Stored XSS via metric names and label values in Prometheus web UI in github.com/prometheus/prometheus

  GO-2026-5710: Prometheus Azure AD remote write OAuth client secret exposed via config API in github.com/prometheus/prometheus

Apr 15, 2025 GO-2026-5264 +3 more

  GO-2026-5264: Prometheus: Remote read endpoint allows denial of service via crafted snappy payload in github.com/prometheus/prometheus

  GO-2026-5381: Prometheus vulnerable to stored XSS via crafted histogram bucket label values in the old web UI heatmap display in github.com/prometheus/prometheus

  GO-2026-5662: Prometheus has Stored XSS via metric names and label values in Prometheus web UI in github.com/prometheus/prometheus

  GO-2026-5710: Prometheus Azure AD remote write OAuth client secret exposed via config API in github.com/prometheus/prometheus

Apr 3, 2025 GO-2026-5264 +3 more

  GO-2026-5264: Prometheus: Remote read endpoint allows denial of service via crafted snappy payload in github.com/prometheus/prometheus

  GO-2026-5381: Prometheus vulnerable to stored XSS via crafted histogram bucket label values in the old web UI heatmap display in github.com/prometheus/prometheus

  GO-2026-5662: Prometheus has Stored XSS via metric names and label values in Prometheus web UI in github.com/prometheus/prometheus

  GO-2026-5710: Prometheus Azure AD remote write OAuth client secret exposed via config API in github.com/prometheus/prometheus

Mar 26, 2025 GO-2026-5264 +3 more

  GO-2026-5264: Prometheus: Remote read endpoint allows denial of service via crafted snappy payload in github.com/prometheus/prometheus

  GO-2026-5381: Prometheus vulnerable to stored XSS via crafted histogram bucket label values in the old web UI heatmap display in github.com/prometheus/prometheus

  GO-2026-5662: Prometheus has Stored XSS via metric names and label values in Prometheus web UI in github.com/prometheus/prometheus

  GO-2026-5710: Prometheus Azure AD remote write OAuth client secret exposed via config API in github.com/prometheus/prometheus

Feb 25, 2025 GO-2026-5264 +3 more

  GO-2026-5264: Prometheus: Remote read endpoint allows denial of service via crafted snappy payload in github.com/prometheus/prometheus

  GO-2026-5381: Prometheus vulnerable to stored XSS via crafted histogram bucket label values in the old web UI heatmap display in github.com/prometheus/prometheus

  GO-2026-5662: Prometheus has Stored XSS via metric names and label values in Prometheus web UI in github.com/prometheus/prometheus

  GO-2026-5710: Prometheus Azure AD remote write OAuth client secret exposed via config API in github.com/prometheus/prometheus

Feb 17, 2025 GO-2026-5264 +3 more

  GO-2026-5264: Prometheus: Remote read endpoint allows denial of service via crafted snappy payload in github.com/prometheus/prometheus

  GO-2026-5381: Prometheus vulnerable to stored XSS via crafted histogram bucket label values in the old web UI heatmap display in github.com/prometheus/prometheus

  GO-2026-5662: Prometheus has Stored XSS via metric names and label values in Prometheus web UI in github.com/prometheus/prometheus

  GO-2026-5710: Prometheus Azure AD remote write OAuth client secret exposed via config API in github.com/prometheus/prometheus

Feb 4, 2025 GO-2026-5264 +3 more

  GO-2026-5264: Prometheus: Remote read endpoint allows denial of service via crafted snappy payload in github.com/prometheus/prometheus

  GO-2026-5381: Prometheus vulnerable to stored XSS via crafted histogram bucket label values in the old web UI heatmap display in github.com/prometheus/prometheus

  GO-2026-5662: Prometheus has Stored XSS via metric names and label values in Prometheus web UI in github.com/prometheus/prometheus

  GO-2026-5710: Prometheus Azure AD remote write OAuth client secret exposed via config API in github.com/prometheus/prometheus

Feb 4, 2025 GO-2026-5264 +3 more

  GO-2026-5264: Prometheus: Remote read endpoint allows denial of service via crafted snappy payload in github.com/prometheus/prometheus

  GO-2026-5381: Prometheus vulnerable to stored XSS via crafted histogram bucket label values in the old web UI heatmap display in github.com/prometheus/prometheus

  GO-2026-5662: Prometheus has Stored XSS via metric names and label values in Prometheus web UI in github.com/prometheus/prometheus

  GO-2026-5710: Prometheus Azure AD remote write OAuth client secret exposed via config API in github.com/prometheus/prometheus

Jan 2, 2025 GO-2026-5264 +3 more

  GO-2026-5264: Prometheus: Remote read endpoint allows denial of service via crafted snappy payload in github.com/prometheus/prometheus

  GO-2026-5381: Prometheus vulnerable to stored XSS via crafted histogram bucket label values in the old web UI heatmap display in github.com/prometheus/prometheus

  GO-2026-5662: Prometheus has Stored XSS via metric names and label values in Prometheus web UI in github.com/prometheus/prometheus

  GO-2026-5710: Prometheus Azure AD remote write OAuth client secret exposed via config API in github.com/prometheus/prometheus

Changes in this version

+ func DefaultPostingsDecoderFactory(_ *BlockMeta) index.PostingsDecoder

type HeadAndOOOIndexReader

+ func (h HeadAndOOOIndexReader) PostingsForAllLabelValues(ctx context.Context, name string) index.Postings

type IndexReader

+ PostingsForAllLabelValues func(ctx context.Context, name string) index.Postings

type LeveledCompactorOptions

+ PD PostingsDecoderFactory

type OOOCompactionHeadIndexReader

+ func (ir *OOOCompactionHeadIndexReader) PostingsForAllLabelValues(context.Context, string) index.Postings

type Options

+ PostingsDecoderFactory PostingsDecoderFactory

+ type PostingsDecoderFactory func(meta *BlockMeta) index.PostingsDecoder

Dec 30, 2024 GO-2026-5264 +3 more

  GO-2026-5264: Prometheus: Remote read endpoint allows denial of service via crafted snappy payload in github.com/prometheus/prometheus

  GO-2026-5381: Prometheus vulnerable to stored XSS via crafted histogram bucket label values in the old web UI heatmap display in github.com/prometheus/prometheus

  GO-2026-5662: Prometheus has Stored XSS via metric names and label values in Prometheus web UI in github.com/prometheus/prometheus

  GO-2026-5710: Prometheus Azure AD remote write OAuth client secret exposed via config API in github.com/prometheus/prometheus

Dec 20, 2024 GO-2026-5264 +3 more

  GO-2026-5264: Prometheus: Remote read endpoint allows denial of service via crafted snappy payload in github.com/prometheus/prometheus

  GO-2026-5381: Prometheus vulnerable to stored XSS via crafted histogram bucket label values in the old web UI heatmap display in github.com/prometheus/prometheus

  GO-2026-5662: Prometheus has Stored XSS via metric names and label values in Prometheus web UI in github.com/prometheus/prometheus

  GO-2026-5710: Prometheus Azure AD remote write OAuth client secret exposed via config API in github.com/prometheus/prometheus

Nov 28, 2024 GO-2026-5264 +3 more

  GO-2026-5264: Prometheus: Remote read endpoint allows denial of service via crafted snappy payload in github.com/prometheus/prometheus

  GO-2026-5381: Prometheus vulnerable to stored XSS via crafted histogram bucket label values in the old web UI heatmap display in github.com/prometheus/prometheus

  GO-2026-5662: Prometheus has Stored XSS via metric names and label values in Prometheus web UI in github.com/prometheus/prometheus

  GO-2026-5710: Prometheus Azure AD remote write OAuth client secret exposed via config API in github.com/prometheus/prometheus

Nov 14, 2024 GO-2026-5264 +3 more

  GO-2026-5264: Prometheus: Remote read endpoint allows denial of service via crafted snappy payload in github.com/prometheus/prometheus

  GO-2026-5381: Prometheus vulnerable to stored XSS via crafted histogram bucket label values in the old web UI heatmap display in github.com/prometheus/prometheus

  GO-2026-5662: Prometheus has Stored XSS via metric names and label values in Prometheus web UI in github.com/prometheus/prometheus

  GO-2026-5710: Prometheus Azure AD remote write OAuth client secret exposed via config API in github.com/prometheus/prometheus

Changes in this version

+ const DefaultCompactionDelayMaxPercent

type DB

+ func (db *DB) DisableOOONativeHistograms()

+ func (db *DB) EnableOOONativeHistograms()

type Head

+ func (h *Head) DisableOOONativeHistograms()

+ func (h *Head) EnableOOONativeHistograms()

type HeadOptions

+ EnableOOONativeHistograms atomic.Bool

type Options

+ CompactionDelayMaxPercent int

+ EnableOOONativeHistograms bool

Nov 11, 2024 GO-2026-5264 +3 more

  GO-2026-5264: Prometheus: Remote read endpoint allows denial of service via crafted snappy payload in github.com/prometheus/prometheus

  GO-2026-5381: Prometheus vulnerable to stored XSS via crafted histogram bucket label values in the old web UI heatmap display in github.com/prometheus/prometheus

  GO-2026-5662: Prometheus has Stored XSS via metric names and label values in Prometheus web UI in github.com/prometheus/prometheus

  GO-2026-5710: Prometheus Azure AD remote write OAuth client secret exposed via config API in github.com/prometheus/prometheus

Oct 31, 2024 GO-2026-5264 +3 more

  GO-2026-5264: Prometheus: Remote read endpoint allows denial of service via crafted snappy payload in github.com/prometheus/prometheus

  GO-2026-5381: Prometheus vulnerable to stored XSS via crafted histogram bucket label values in the old web UI heatmap display in github.com/prometheus/prometheus

  GO-2026-5662: Prometheus has Stored XSS via metric names and label values in Prometheus web UI in github.com/prometheus/prometheus

  GO-2026-5710: Prometheus Azure AD remote write OAuth client secret exposed via config API in github.com/prometheus/prometheus

Oct 14, 2024 GO-2026-5264 +3 more

  GO-2026-5264: Prometheus: Remote read endpoint allows denial of service via crafted snappy payload in github.com/prometheus/prometheus

  GO-2026-5381: Prometheus vulnerable to stored XSS via crafted histogram bucket label values in the old web UI heatmap display in github.com/prometheus/prometheus

  GO-2026-5662: Prometheus has Stored XSS via metric names and label values in Prometheus web UI in github.com/prometheus/prometheus

  GO-2026-5710: Prometheus Azure AD remote write OAuth client secret exposed via config API in github.com/prometheus/prometheus

Sep 10, 2024 GO-2026-5264 +3 more

  GO-2026-5264: Prometheus: Remote read endpoint allows denial of service via crafted snappy payload in github.com/prometheus/prometheus

  GO-2026-5381: Prometheus vulnerable to stored XSS via crafted histogram bucket label values in the old web UI heatmap display in github.com/prometheus/prometheus

  GO-2026-5662: Prometheus has Stored XSS via metric names and label values in Prometheus web UI in github.com/prometheus/prometheus

  GO-2026-5710: Prometheus Azure AD remote write OAuth client secret exposed via config API in github.com/prometheus/prometheus

Nov 4, 2024 GO-2026-5264 +3 more

  GO-2026-5264: Prometheus: Remote read endpoint allows denial of service via crafted snappy payload in github.com/prometheus/prometheus

  GO-2026-5381: Prometheus vulnerable to stored XSS via crafted histogram bucket label values in the old web UI heatmap display in github.com/prometheus/prometheus

  GO-2026-5662: Prometheus has Stored XSS via metric names and label values in Prometheus web UI in github.com/prometheus/prometheus

  GO-2026-5710: Prometheus Azure AD remote write OAuth client secret exposed via config API in github.com/prometheus/prometheus

Oct 22, 2024 GO-2026-5264 +3 more

  GO-2026-5264: Prometheus: Remote read endpoint allows denial of service via crafted snappy payload in github.com/prometheus/prometheus

  GO-2026-5381: Prometheus vulnerable to stored XSS via crafted histogram bucket label values in the old web UI heatmap display in github.com/prometheus/prometheus

  GO-2026-5662: Prometheus has Stored XSS via metric names and label values in Prometheus web UI in github.com/prometheus/prometheus

  GO-2026-5710: Prometheus Azure AD remote write OAuth client secret exposed via config API in github.com/prometheus/prometheus

Changes in this version

+ func NewHeadAndOOOChunkQuerier(inoMint, mint, maxt int64, head *Head, oooIsoState *oooIsolationState, ...) storage.ChunkQuerier

+ func NewHeadAndOOOQuerier(inoMint, mint, maxt int64, head *Head, oooIsoState *oooIsolationState, ...) storage.Querier

+ type ChunkReaderWithCopy interface

+ ChunkOrIterableWithCopy func(meta chunks.Meta) (chunkenc.Chunk, chunkenc.Iterable, int64, error)

+ type HeadAndOOOChunkQuerier struct

+ func (q *HeadAndOOOChunkQuerier) Close() error

+ func (q *HeadAndOOOChunkQuerier) LabelNames(ctx context.Context, hints *storage.LabelHints, matchers ...*labels.Matcher) ([]string, annotations.Annotations, error)

+ func (q *HeadAndOOOChunkQuerier) LabelValues(ctx context.Context, name string, hints *storage.LabelHints, ...) ([]string, annotations.Annotations, error)

+ func (q *HeadAndOOOChunkQuerier) Select(ctx context.Context, sortSeries bool, hints *storage.SelectHints, ...) storage.ChunkSeriesSet

+ type HeadAndOOOChunkReader struct

+ func NewHeadAndOOOChunkReader(head *Head, mint, maxt int64, cr *headChunkReader, ...) *HeadAndOOOChunkReader

+ func (cr *HeadAndOOOChunkReader) ChunkOrIterable(meta chunks.Meta) (chunkenc.Chunk, chunkenc.Iterable, error)

+ func (cr *HeadAndOOOChunkReader) ChunkOrIterableWithCopy(meta chunks.Meta) (chunkenc.Chunk, chunkenc.Iterable, int64, error)

+ func (cr *HeadAndOOOChunkReader) Close() error

+ type HeadAndOOOIndexReader struct

+ func NewHeadAndOOOIndexReader(head *Head, inoMint, mint, maxt int64, ...) *HeadAndOOOIndexReader

+ func (h HeadAndOOOIndexReader) Close() error

+ func (h HeadAndOOOIndexReader) LabelNames(ctx context.Context, matchers ...*labels.Matcher) ([]string, error)

+ func (h HeadAndOOOIndexReader) LabelNamesFor(ctx context.Context, series index.Postings) ([]string, error)

+ func (h HeadAndOOOIndexReader) LabelValueFor(_ context.Context, id storage.SeriesRef, label string) (string, error)

+ func (h HeadAndOOOIndexReader) Postings(ctx context.Context, name string, values ...string) (index.Postings, error)

+ func (h HeadAndOOOIndexReader) PostingsForLabelMatching(ctx context.Context, name string, match func(string) bool) index.Postings

+ func (h HeadAndOOOIndexReader) ShardedPostings(p index.Postings, shardIndex, shardCount uint64) index.Postings

+ func (h HeadAndOOOIndexReader) SortedLabelValues(ctx context.Context, name string, matchers ...*labels.Matcher) ([]string, error)

+ func (h HeadAndOOOIndexReader) SortedPostings(p index.Postings) index.Postings

+ func (h HeadAndOOOIndexReader) Symbols() index.StringIter

+ func (oh *HeadAndOOOIndexReader) LabelValues(ctx context.Context, name string, matchers ...*labels.Matcher) ([]string, error)

+ func (oh *HeadAndOOOIndexReader) Series(ref storage.SeriesRef, builder *labels.ScratchBuilder, chks *[]chunks.Meta) error

+ type HeadAndOOOQuerier struct

+ func (q *HeadAndOOOQuerier) Close() error

+ func (q *HeadAndOOOQuerier) LabelNames(ctx context.Context, hints *storage.LabelHints, matchers ...*labels.Matcher) ([]string, annotations.Annotations, error)

+ func (q *HeadAndOOOQuerier) LabelValues(ctx context.Context, name string, hints *storage.LabelHints, ...) ([]string, annotations.Annotations, error)

+ func (q *HeadAndOOOQuerier) Select(ctx context.Context, sortSeries bool, hints *storage.SelectHints, ...) storage.SeriesSet

type Options

+ CompactionDelay time.Duration

+ EnableDelayedCompaction bool

Aug 27, 2024 GO-2026-5264 +3 more

  GO-2026-5264: Prometheus: Remote read endpoint allows denial of service via crafted snappy payload in github.com/prometheus/prometheus

  GO-2026-5381: Prometheus vulnerable to stored XSS via crafted histogram bucket label values in the old web UI heatmap display in github.com/prometheus/prometheus

  GO-2026-5662: Prometheus has Stored XSS via metric names and label values in Prometheus web UI in github.com/prometheus/prometheus

  GO-2026-5710: Prometheus Azure AD remote write OAuth client secret exposed via config API in github.com/prometheus/prometheus

Aug 9, 2024 GO-2026-5264 +3 more

  GO-2026-5264: Prometheus: Remote read endpoint allows denial of service via crafted snappy payload in github.com/prometheus/prometheus

  GO-2026-5381: Prometheus vulnerable to stored XSS via crafted histogram bucket label values in the old web UI heatmap display in github.com/prometheus/prometheus

  GO-2026-5662: Prometheus has Stored XSS via metric names and label values in Prometheus web UI in github.com/prometheus/prometheus

  GO-2026-5710: Prometheus Azure AD remote write OAuth client secret exposed via config API in github.com/prometheus/prometheus

Changes in this version

+ func AllSortedPostings(ctx context.Context, reader IndexReader) index.Postings

+ type BlockChunkQuerierFunc func(b BlockReader, mint, maxt int64) (storage.ChunkQuerier, error)

+ type BlockQuerierFunc func(b BlockReader, mint, maxt int64) (storage.Querier, error)

type Head

+ func (h *Head) RebuildSymbolTable(logger log.Logger) *labels.SymbolTable

+ type IndexReaderPostingsFunc func(ctx context.Context, reader IndexReader) index.Postings

type OOOChunk

+ func (o *OOOChunk) ToEncodedChunks(mint, maxt int64) (chks []memChunk, err error)

type Options

+ BlockChunkQuerierFunc BlockChunkQuerierFunc

+ BlockQuerierFunc BlockQuerierFunc

Jul 30, 2024 GO-2026-5264 +3 more

  GO-2026-5264: Prometheus: Remote read endpoint allows denial of service via crafted snappy payload in github.com/prometheus/prometheus

  GO-2026-5381: Prometheus vulnerable to stored XSS via crafted histogram bucket label values in the old web UI heatmap display in github.com/prometheus/prometheus

  GO-2026-5662: Prometheus has Stored XSS via metric names and label values in Prometheus web UI in github.com/prometheus/prometheus

  GO-2026-5710: Prometheus Azure AD remote write OAuth client secret exposed via config API in github.com/prometheus/prometheus

Mar 18, 2025 GO-2026-5264 +3 more

  GO-2026-5264: Prometheus: Remote read endpoint allows denial of service via crafted snappy payload in github.com/prometheus/prometheus

  GO-2026-5381: Prometheus vulnerable to stored XSS via crafted histogram bucket label values in the old web UI heatmap display in github.com/prometheus/prometheus

  GO-2026-5662: Prometheus has Stored XSS via metric names and label values in Prometheus web UI in github.com/prometheus/prometheus

  GO-2026-5710: Prometheus Azure AD remote write OAuth client secret exposed via config API in github.com/prometheus/prometheus

Nov 5, 2024 GO-2026-5264 +3 more

  GO-2026-5264: Prometheus: Remote read endpoint allows denial of service via crafted snappy payload in github.com/prometheus/prometheus

  GO-2026-5381: Prometheus vulnerable to stored XSS via crafted histogram bucket label values in the old web UI heatmap display in github.com/prometheus/prometheus

  GO-2026-5662: Prometheus has Stored XSS via metric names and label values in Prometheus web UI in github.com/prometheus/prometheus

  GO-2026-5710: Prometheus Azure AD remote write OAuth client secret exposed via config API in github.com/prometheus/prometheus

Aug 9, 2024 GO-2026-5264 +3 more

  GO-2026-5264: Prometheus: Remote read endpoint allows denial of service via crafted snappy payload in github.com/prometheus/prometheus

  GO-2026-5381: Prometheus vulnerable to stored XSS via crafted histogram bucket label values in the old web UI heatmap display in github.com/prometheus/prometheus

  GO-2026-5662: Prometheus has Stored XSS via metric names and label values in Prometheus web UI in github.com/prometheus/prometheus

  GO-2026-5710: Prometheus Azure AD remote write OAuth client secret exposed via config API in github.com/prometheus/prometheus

Jul 10, 2024 GO-2026-5264 +3 more

  GO-2026-5264: Prometheus: Remote read endpoint allows denial of service via crafted snappy payload in github.com/prometheus/prometheus

  GO-2026-5381: Prometheus vulnerable to stored XSS via crafted histogram bucket label values in the old web UI heatmap display in github.com/prometheus/prometheus

  GO-2026-5662: Prometheus has Stored XSS via metric names and label values in Prometheus web UI in github.com/prometheus/prometheus

  GO-2026-5710: Prometheus Azure AD remote write OAuth client secret exposed via config API in github.com/prometheus/prometheus

Jun 18, 2024 GO-2026-5264 +3 more

  GO-2026-5264: Prometheus: Remote read endpoint allows denial of service via crafted snappy payload in github.com/prometheus/prometheus

  GO-2026-5381: Prometheus vulnerable to stored XSS via crafted histogram bucket label values in the old web UI heatmap display in github.com/prometheus/prometheus

  GO-2026-5662: Prometheus has Stored XSS via metric names and label values in Prometheus web UI in github.com/prometheus/prometheus

  GO-2026-5710: Prometheus Azure AD remote write OAuth client secret exposed via config API in github.com/prometheus/prometheus

Changes in this version

type IndexReader

+ PostingsForLabelMatching func(ctx context.Context, name string, match func(value string) bool) index.Postings

+ type NewCompactorFunc func(ctx context.Context, r prometheus.Registerer, l log.Logger, ranges []int64, ...) (Compactor, error)

type OOOCompactionHeadIndexReader

+ func (ir *OOOCompactionHeadIndexReader) PostingsForLabelMatching(context.Context, string, func(string) bool) index.Postings

type OOOHeadIndexReader

+ func (h OOOHeadIndexReader) PostingsForLabelMatching(ctx context.Context, name string, match func(string) bool) index.Postings

type Options

+ NewCompactorFunc NewCompactorFunc

Jun 11, 2024 GO-2026-5264 +3 more

  GO-2026-5264: Prometheus: Remote read endpoint allows denial of service via crafted snappy payload in github.com/prometheus/prometheus

  GO-2026-5381: Prometheus vulnerable to stored XSS via crafted histogram bucket label values in the old web UI heatmap display in github.com/prometheus/prometheus

  GO-2026-5662: Prometheus has Stored XSS via metric names and label values in Prometheus web UI in github.com/prometheus/prometheus

  GO-2026-5710: Prometheus Azure AD remote write OAuth client secret exposed via config API in github.com/prometheus/prometheus

Jun 7, 2024 GO-2026-5264 +3 more

  GO-2026-5264: Prometheus: Remote read endpoint allows denial of service via crafted snappy payload in github.com/prometheus/prometheus

  GO-2026-5381: Prometheus vulnerable to stored XSS via crafted histogram bucket label values in the old web UI heatmap display in github.com/prometheus/prometheus

  GO-2026-5662: Prometheus has Stored XSS via metric names and label values in Prometheus web UI in github.com/prometheus/prometheus

  GO-2026-5710: Prometheus Azure AD remote write OAuth client secret exposed via config API in github.com/prometheus/prometheus

May 30, 2024 GO-2026-5264 +3 more

  GO-2026-5264: Prometheus: Remote read endpoint allows denial of service via crafted snappy payload in github.com/prometheus/prometheus

  GO-2026-5381: Prometheus vulnerable to stored XSS via crafted histogram bucket label values in the old web UI heatmap display in github.com/prometheus/prometheus

  GO-2026-5662: Prometheus has Stored XSS via metric names and label values in Prometheus web UI in github.com/prometheus/prometheus

  GO-2026-5710: Prometheus Azure AD remote write OAuth client secret exposed via config API in github.com/prometheus/prometheus

May 8, 2024 GO-2026-5264 +3 more

  GO-2026-5264: Prometheus: Remote read endpoint allows denial of service via crafted snappy payload in github.com/prometheus/prometheus

  GO-2026-5381: Prometheus vulnerable to stored XSS via crafted histogram bucket label values in the old web UI heatmap display in github.com/prometheus/prometheus

  GO-2026-5662: Prometheus has Stored XSS via metric names and label values in Prometheus web UI in github.com/prometheus/prometheus

  GO-2026-5710: Prometheus Azure AD remote write OAuth client secret exposed via config API in github.com/prometheus/prometheus

Changes in this version

type CompactorMetrics

+ func NewCompactorMetrics(r prometheus.Registerer) *CompactorMetrics

May 3, 2024 GO-2026-5264 +3 more

  GO-2026-5264: Prometheus: Remote read endpoint allows denial of service via crafted snappy payload in github.com/prometheus/prometheus

  GO-2026-5381: Prometheus vulnerable to stored XSS via crafted histogram bucket label values in the old web UI heatmap display in github.com/prometheus/prometheus

  GO-2026-5662: Prometheus has Stored XSS via metric names and label values in Prometheus web UI in github.com/prometheus/prometheus

  GO-2026-5710: Prometheus Azure AD remote write OAuth client secret exposed via config API in github.com/prometheus/prometheus

Apr 30, 2024 GO-2026-5264 +3 more

  GO-2026-5264: Prometheus: Remote read endpoint allows denial of service via crafted snappy payload in github.com/prometheus/prometheus

  GO-2026-5381: Prometheus vulnerable to stored XSS via crafted histogram bucket label values in the old web UI heatmap display in github.com/prometheus/prometheus

  GO-2026-5662: Prometheus has Stored XSS via metric names and label values in Prometheus web UI in github.com/prometheus/prometheus

  GO-2026-5710: Prometheus Azure AD remote write OAuth client secret exposed via config API in github.com/prometheus/prometheus

Apr 10, 2024 GO-2026-5264 +3 more

  GO-2026-5264: Prometheus: Remote read endpoint allows denial of service via crafted snappy payload in github.com/prometheus/prometheus

  GO-2026-5381: Prometheus vulnerable to stored XSS via crafted histogram bucket label values in the old web UI heatmap display in github.com/prometheus/prometheus

  GO-2026-5662: Prometheus has Stored XSS via metric names and label values in Prometheus web UI in github.com/prometheus/prometheus

  GO-2026-5710: Prometheus Azure AD remote write OAuth client secret exposed via config API in github.com/prometheus/prometheus

Mar 28, 2024 GO-2026-5264 +3 more

  GO-2026-5264: Prometheus: Remote read endpoint allows denial of service via crafted snappy payload in github.com/prometheus/prometheus

  GO-2026-5381: Prometheus vulnerable to stored XSS via crafted histogram bucket label values in the old web UI heatmap display in github.com/prometheus/prometheus

  GO-2026-5662: Prometheus has Stored XSS via metric names and label values in Prometheus web UI in github.com/prometheus/prometheus

  GO-2026-5710: Prometheus Azure AD remote write OAuth client secret exposed via config API in github.com/prometheus/prometheus

Mar 19, 2024 GO-2026-5264 +3 more

  GO-2026-5264: Prometheus: Remote read endpoint allows denial of service via crafted snappy payload in github.com/prometheus/prometheus

  GO-2026-5381: Prometheus vulnerable to stored XSS via crafted histogram bucket label values in the old web UI heatmap display in github.com/prometheus/prometheus

  GO-2026-5662: Prometheus has Stored XSS via metric names and label values in Prometheus web UI in github.com/prometheus/prometheus

  GO-2026-5710: Prometheus Azure AD remote write OAuth client secret exposed via config API in github.com/prometheus/prometheus

Changes in this version

type HeadOptions

+ EnableSharding bool

type IndexReader

+ ShardedPostings func(p index.Postings, shardIndex, shardCount uint64) index.Postings

type OOOCompactionHeadIndexReader

+ func (ir *OOOCompactionHeadIndexReader) ShardedPostings(p index.Postings, shardIndex, shardCount uint64) index.Postings

type OOOHeadIndexReader

+ func (h OOOHeadIndexReader) ShardedPostings(p index.Postings, shardIndex, shardCount uint64) index.Postings

type Options

+ EnableSharding bool

Feb 26, 2024 GO-2026-5264 +3 more

  GO-2026-5264: Prometheus: Remote read endpoint allows denial of service via crafted snappy payload in github.com/prometheus/prometheus

  GO-2026-5381: Prometheus vulnerable to stored XSS via crafted histogram bucket label values in the old web UI heatmap display in github.com/prometheus/prometheus

  GO-2026-5662: Prometheus has Stored XSS via metric names and label values in Prometheus web UI in github.com/prometheus/prometheus

  GO-2026-5710: Prometheus Azure AD remote write OAuth client secret exposed via config API in github.com/prometheus/prometheus

Feb 22, 2024 GO-2026-5264 +3 more

  GO-2026-5264: Prometheus: Remote read endpoint allows denial of service via crafted snappy payload in github.com/prometheus/prometheus

  GO-2026-5381: Prometheus vulnerable to stored XSS via crafted histogram bucket label values in the old web UI heatmap display in github.com/prometheus/prometheus

  GO-2026-5662: Prometheus has Stored XSS via metric names and label values in Prometheus web UI in github.com/prometheus/prometheus

  GO-2026-5710: Prometheus Azure AD remote write OAuth client secret exposed via config API in github.com/prometheus/prometheus

Changes in this version

type HeadOptions

+ EnableCreatedTimestampZeroIngestion bool

type LeveledCompactor

+ func NewLeveledCompactorWithOptions(ctx context.Context, r prometheus.Registerer, l log.Logger, ranges []int64, ...) (*LeveledCompactor, error)

+ type LeveledCompactorOptions struct

+ EnableOverlappingCompaction bool

+ MaxBlockChunkSegmentSize int64

+ MergeFunc storage.VerticalChunkSeriesMergeFunc

+ PE index.PostingsEncoder

type Options

+ EnableOverlappingCompaction bool

Feb 19, 2024 GO-2026-5264 +3 more

  GO-2026-5264: Prometheus: Remote read endpoint allows denial of service via crafted snappy payload in github.com/prometheus/prometheus

  GO-2026-5381: Prometheus vulnerable to stored XSS via crafted histogram bucket label values in the old web UI heatmap display in github.com/prometheus/prometheus

  GO-2026-5662: Prometheus has Stored XSS via metric names and label values in Prometheus web UI in github.com/prometheus/prometheus

  GO-2026-5710: Prometheus Azure AD remote write OAuth client secret exposed via config API in github.com/prometheus/prometheus

Feb 13, 2024 GO-2026-5264 +3 more

  GO-2026-5264: Prometheus: Remote read endpoint allows denial of service via crafted snappy payload in github.com/prometheus/prometheus

  GO-2026-5381: Prometheus vulnerable to stored XSS via crafted histogram bucket label values in the old web UI heatmap display in github.com/prometheus/prometheus

  GO-2026-5662: Prometheus has Stored XSS via metric names and label values in Prometheus web UI in github.com/prometheus/prometheus

  GO-2026-5710: Prometheus Azure AD remote write OAuth client secret exposed via config API in github.com/prometheus/prometheus

Jan 15, 2024 GO-2026-5264 +3 more

  GO-2026-5264: Prometheus: Remote read endpoint allows denial of service via crafted snappy payload in github.com/prometheus/prometheus

  GO-2026-5381: Prometheus vulnerable to stored XSS via crafted histogram bucket label values in the old web UI heatmap display in github.com/prometheus/prometheus

  GO-2026-5662: Prometheus has Stored XSS via metric names and label values in Prometheus web UI in github.com/prometheus/prometheus

  GO-2026-5710: Prometheus Azure AD remote write OAuth client secret exposed via config API in github.com/prometheus/prometheus

Jan 15, 2024 GO-2026-5264 +3 more

  GO-2026-5264: Prometheus: Remote read endpoint allows denial of service via crafted snappy payload in github.com/prometheus/prometheus

  GO-2026-5381: Prometheus vulnerable to stored XSS via crafted histogram bucket label values in the old web UI heatmap display in github.com/prometheus/prometheus

  GO-2026-5662: Prometheus has Stored XSS via metric names and label values in Prometheus web UI in github.com/prometheus/prometheus

  GO-2026-5710: Prometheus Azure AD remote write OAuth client secret exposed via config API in github.com/prometheus/prometheus

Changes in this version

type ChunkReader

+ ChunkOrIterable func(meta chunks.Meta) (chunkenc.Chunk, chunkenc.Iterable, error)

type Head

+ func (h *Head) WaitForPendingReadersForOOOChunksAtOrBefore(chunk chunks.ChunkDiskMapperRef)

type OOOHeadChunkReader

+ func (cr OOOHeadChunkReader) ChunkOrIterable(meta chunks.Meta) (chunkenc.Chunk, chunkenc.Iterable, error)

Jan 8, 2024 GO-2026-5264 +3 more

  GO-2026-5264: Prometheus: Remote read endpoint allows denial of service via crafted snappy payload in github.com/prometheus/prometheus

  GO-2026-5381: Prometheus vulnerable to stored XSS via crafted histogram bucket label values in the old web UI heatmap display in github.com/prometheus/prometheus

  GO-2026-5662: Prometheus has Stored XSS via metric names and label values in Prometheus web UI in github.com/prometheus/prometheus

  GO-2026-5710: Prometheus Azure AD remote write OAuth client secret exposed via config API in github.com/prometheus/prometheus

Dec 20, 2023 GO-2026-5264 +3 more

  GO-2026-5264: Prometheus: Remote read endpoint allows denial of service via crafted snappy payload in github.com/prometheus/prometheus

  GO-2026-5381: Prometheus vulnerable to stored XSS via crafted histogram bucket label values in the old web UI heatmap display in github.com/prometheus/prometheus

  GO-2026-5662: Prometheus has Stored XSS via metric names and label values in Prometheus web UI in github.com/prometheus/prometheus

  GO-2026-5710: Prometheus Azure AD remote write OAuth client secret exposed via config API in github.com/prometheus/prometheus

Dec 12, 2023 GO-2026-5264 +3 more

  GO-2026-5264: Prometheus: Remote read endpoint allows denial of service via crafted snappy payload in github.com/prometheus/prometheus

  GO-2026-5381: Prometheus vulnerable to stored XSS via crafted histogram bucket label values in the old web UI heatmap display in github.com/prometheus/prometheus

  GO-2026-5662: Prometheus has Stored XSS via metric names and label values in Prometheus web UI in github.com/prometheus/prometheus

  GO-2026-5710: Prometheus Azure AD remote write OAuth client secret exposed via config API in github.com/prometheus/prometheus

Dec 8, 2023 GO-2026-5264 +3 more

  GO-2026-5264: Prometheus: Remote read endpoint allows denial of service via crafted snappy payload in github.com/prometheus/prometheus

  GO-2026-5381: Prometheus vulnerable to stored XSS via crafted histogram bucket label values in the old web UI heatmap display in github.com/prometheus/prometheus

  GO-2026-5662: Prometheus has Stored XSS via metric names and label values in Prometheus web UI in github.com/prometheus/prometheus

  GO-2026-5710: Prometheus Azure AD remote write OAuth client secret exposed via config API in github.com/prometheus/prometheus

Nov 15, 2023 GO-2026-5264 +3 more

  GO-2026-5264: Prometheus: Remote read endpoint allows denial of service via crafted snappy payload in github.com/prometheus/prometheus

  GO-2026-5381: Prometheus vulnerable to stored XSS via crafted histogram bucket label values in the old web UI heatmap display in github.com/prometheus/prometheus

  GO-2026-5662: Prometheus has Stored XSS via metric names and label values in Prometheus web UI in github.com/prometheus/prometheus

  GO-2026-5710: Prometheus Azure AD remote write OAuth client secret exposed via config API in github.com/prometheus/prometheus

Changes in this version

type DB

+ func (db *DB) ForceHeadMMap()

Nov 2, 2023 GO-2026-5264 +3 more

  GO-2026-5264: Prometheus: Remote read endpoint allows denial of service via crafted snappy payload in github.com/prometheus/prometheus

  GO-2026-5381: Prometheus vulnerable to stored XSS via crafted histogram bucket label values in the old web UI heatmap display in github.com/prometheus/prometheus

  GO-2026-5662: Prometheus has Stored XSS via metric names and label values in Prometheus web UI in github.com/prometheus/prometheus

  GO-2026-5710: Prometheus Azure AD remote write OAuth client secret exposed via config API in github.com/prometheus/prometheus

Oct 27, 2023 GO-2026-5264 +3 more

  GO-2026-5264: Prometheus: Remote read endpoint allows denial of service via crafted snappy payload in github.com/prometheus/prometheus

  GO-2026-5381: Prometheus vulnerable to stored XSS via crafted histogram bucket label values in the old web UI heatmap display in github.com/prometheus/prometheus

  GO-2026-5662: Prometheus has Stored XSS via metric names and label values in Prometheus web UI in github.com/prometheus/prometheus

  GO-2026-5710: Prometheus Azure AD remote write OAuth client secret exposed via config API in github.com/prometheus/prometheus

Oct 17, 2023 GO-2026-5264 +3 more

  GO-2026-5264: Prometheus: Remote read endpoint allows denial of service via crafted snappy payload in github.com/prometheus/prometheus

  GO-2026-5381: Prometheus vulnerable to stored XSS via crafted histogram bucket label values in the old web UI heatmap display in github.com/prometheus/prometheus

  GO-2026-5662: Prometheus has Stored XSS via metric names and label values in Prometheus web UI in github.com/prometheus/prometheus

  GO-2026-5710: Prometheus Azure AD remote write OAuth client secret exposed via config API in github.com/prometheus/prometheus

Oct 12, 2023 GO-2026-5264 +3 more

  GO-2026-5264: Prometheus: Remote read endpoint allows denial of service via crafted snappy payload in github.com/prometheus/prometheus

  GO-2026-5381: Prometheus vulnerable to stored XSS via crafted histogram bucket label values in the old web UI heatmap display in github.com/prometheus/prometheus

  GO-2026-5662: Prometheus has Stored XSS via metric names and label values in Prometheus web UI in github.com/prometheus/prometheus

  GO-2026-5710: Prometheus Azure AD remote write OAuth client secret exposed via config API in github.com/prometheus/prometheus

Oct 4, 2023 GO-2026-5264 +3 more

  GO-2026-5264: Prometheus: Remote read endpoint allows denial of service via crafted snappy payload in github.com/prometheus/prometheus

  GO-2026-5381: Prometheus vulnerable to stored XSS via crafted histogram bucket label values in the old web UI heatmap display in github.com/prometheus/prometheus

  GO-2026-5662: Prometheus has Stored XSS via metric names and label values in Prometheus web UI in github.com/prometheus/prometheus

  GO-2026-5710: Prometheus Azure AD remote write OAuth client secret exposed via config API in github.com/prometheus/prometheus

Sep 6, 2023 GO-2026-5264 +3 more

  GO-2026-5264: Prometheus: Remote read endpoint allows denial of service via crafted snappy payload in github.com/prometheus/prometheus

  GO-2026-5381: Prometheus vulnerable to stored XSS via crafted histogram bucket label values in the old web UI heatmap display in github.com/prometheus/prometheus

  GO-2026-5662: Prometheus has Stored XSS via metric names and label values in Prometheus web UI in github.com/prometheus/prometheus

  GO-2026-5710: Prometheus Azure AD remote write OAuth client secret exposed via config API in github.com/prometheus/prometheus

Aug 31, 2023 GO-2026-5264 +3 more

  GO-2026-5264: Prometheus: Remote read endpoint allows denial of service via crafted snappy payload in github.com/prometheus/prometheus

  GO-2026-5381: Prometheus vulnerable to stored XSS via crafted histogram bucket label values in the old web UI heatmap display in github.com/prometheus/prometheus

  GO-2026-5662: Prometheus has Stored XSS via metric names and label values in Prometheus web UI in github.com/prometheus/prometheus

  GO-2026-5710: Prometheus Azure AD remote write OAuth client secret exposed via config API in github.com/prometheus/prometheus

Jul 25, 2023 GO-2026-5264 +3 more

  GO-2026-5264: Prometheus: Remote read endpoint allows denial of service via crafted snappy payload in github.com/prometheus/prometheus

  GO-2026-5381: Prometheus vulnerable to stored XSS via crafted histogram bucket label values in the old web UI heatmap display in github.com/prometheus/prometheus

  GO-2026-5662: Prometheus has Stored XSS via metric names and label values in Prometheus web UI in github.com/prometheus/prometheus

  GO-2026-5710: Prometheus Azure AD remote write OAuth client secret exposed via config API in github.com/prometheus/prometheus

Jul 20, 2023 GO-2026-5264 +3 more

  GO-2026-5264: Prometheus: Remote read endpoint allows denial of service via crafted snappy payload in github.com/prometheus/prometheus

  GO-2026-5381: Prometheus vulnerable to stored XSS via crafted histogram bucket label values in the old web UI heatmap display in github.com/prometheus/prometheus

  GO-2026-5662: Prometheus has Stored XSS via metric names and label values in Prometheus web UI in github.com/prometheus/prometheus

  GO-2026-5710: Prometheus Azure AD remote write OAuth client secret exposed via config API in github.com/prometheus/prometheus

Jun 21, 2024 GO-2026-5264 +3 more

  GO-2026-5264: Prometheus: Remote read endpoint allows denial of service via crafted snappy payload in github.com/prometheus/prometheus

  GO-2026-5381: Prometheus vulnerable to stored XSS via crafted histogram bucket label values in the old web UI heatmap display in github.com/prometheus/prometheus

  GO-2026-5662: Prometheus has Stored XSS via metric names and label values in Prometheus web UI in github.com/prometheus/prometheus

  GO-2026-5710: Prometheus Azure AD remote write OAuth client secret exposed via config API in github.com/prometheus/prometheus

May 2, 2024 GO-2026-5264 +3 more

  GO-2026-5264: Prometheus: Remote read endpoint allows denial of service via crafted snappy payload in github.com/prometheus/prometheus

  GO-2026-5381: Prometheus vulnerable to stored XSS via crafted histogram bucket label values in the old web UI heatmap display in github.com/prometheus/prometheus

  GO-2026-5662: Prometheus has Stored XSS via metric names and label values in Prometheus web UI in github.com/prometheus/prometheus

  GO-2026-5710: Prometheus Azure AD remote write OAuth client secret exposed via config API in github.com/prometheus/prometheus

Mar 18, 2024 GO-2026-5264 +3 more

  GO-2026-5264: Prometheus: Remote read endpoint allows denial of service via crafted snappy payload in github.com/prometheus/prometheus

  GO-2026-5381: Prometheus vulnerable to stored XSS via crafted histogram bucket label values in the old web UI heatmap display in github.com/prometheus/prometheus

  GO-2026-5662: Prometheus has Stored XSS via metric names and label values in Prometheus web UI in github.com/prometheus/prometheus

  GO-2026-5710: Prometheus Azure AD remote write OAuth client secret exposed via config API in github.com/prometheus/prometheus

Jan 24, 2024 GO-2026-5264 +3 more

  GO-2026-5264: Prometheus: Remote read endpoint allows denial of service via crafted snappy payload in github.com/prometheus/prometheus

  GO-2026-5381: Prometheus vulnerable to stored XSS via crafted histogram bucket label values in the old web UI heatmap display in github.com/prometheus/prometheus

  GO-2026-5662: Prometheus has Stored XSS via metric names and label values in Prometheus web UI in github.com/prometheus/prometheus

  GO-2026-5710: Prometheus Azure AD remote write OAuth client secret exposed via config API in github.com/prometheus/prometheus

Dec 19, 2023 GO-2026-5264 +3 more

  GO-2026-5264: Prometheus: Remote read endpoint allows denial of service via crafted snappy payload in github.com/prometheus/prometheus

  GO-2026-5381: Prometheus vulnerable to stored XSS via crafted histogram bucket label values in the old web UI heatmap display in github.com/prometheus/prometheus

  GO-2026-5662: Prometheus has Stored XSS via metric names and label values in Prometheus web UI in github.com/prometheus/prometheus

  GO-2026-5710: Prometheus Azure AD remote write OAuth client secret exposed via config API in github.com/prometheus/prometheus

Sep 29, 2023 GO-2026-5264 +2 more

  GO-2026-5264: Prometheus: Remote read endpoint allows denial of service via crafted snappy payload in github.com/prometheus/prometheus

  GO-2026-5381: Prometheus vulnerable to stored XSS via crafted histogram bucket label values in the old web UI heatmap display in github.com/prometheus/prometheus

  GO-2026-5662: Prometheus has Stored XSS via metric names and label values in Prometheus web UI in github.com/prometheus/prometheus

Jun 23, 2023 GO-2026-5264 +2 more

  GO-2026-5264: Prometheus: Remote read endpoint allows denial of service via crafted snappy payload in github.com/prometheus/prometheus

  GO-2026-5381: Prometheus vulnerable to stored XSS via crafted histogram bucket label values in the old web UI heatmap display in github.com/prometheus/prometheus

  GO-2026-5662: Prometheus has Stored XSS via metric names and label values in Prometheus web UI in github.com/prometheus/prometheus

Changes in this version

+ const DefaultSamplesPerChunk

type DB

+ func (db *DB) SetWriteNotified(wn wlog.WriteNotified)

type DBReadOnly

+ func (db *DBReadOnly) Block(blockID string) (BlockReader, error)

+ func (db *DBReadOnly) LastBlockID() (string, error)

type HeadOptions

+ SamplesPerChunk int

type Options

+ SamplesPerChunk int

Jun 20, 2023 GO-2026-5264 +2 more

  GO-2026-5264: Prometheus: Remote read endpoint allows denial of service via crafted snappy payload in github.com/prometheus/prometheus

  GO-2026-5381: Prometheus vulnerable to stored XSS via crafted histogram bucket label values in the old web UI heatmap display in github.com/prometheus/prometheus

  GO-2026-5662: Prometheus has Stored XSS via metric names and label values in Prometheus web UI in github.com/prometheus/prometheus

Jun 7, 2023 GO-2026-5264 +2 more

  GO-2026-5264: Prometheus: Remote read endpoint allows denial of service via crafted snappy payload in github.com/prometheus/prometheus

  GO-2026-5381: Prometheus vulnerable to stored XSS via crafted histogram bucket label values in the old web UI heatmap display in github.com/prometheus/prometheus

  GO-2026-5662: Prometheus has Stored XSS via metric names and label values in Prometheus web UI in github.com/prometheus/prometheus

May 14, 2023 GO-2026-5264 +2 more

  GO-2026-5264: Prometheus: Remote read endpoint allows denial of service via crafted snappy payload in github.com/prometheus/prometheus

  GO-2026-5381: Prometheus vulnerable to stored XSS via crafted histogram bucket label values in the old web UI heatmap display in github.com/prometheus/prometheus

  GO-2026-5662: Prometheus has Stored XSS via metric names and label values in Prometheus web UI in github.com/prometheus/prometheus

Changes in this version

+ func NewBlockChunkSeriesSet(id ulid.ULID, i IndexReader, c ChunkReader, t tombstones.Reader, ...) storage.ChunkSeriesSet

+ type BlockPopulator interface

+ PopulateBlock func(ctx context.Context, metrics *CompactorMetrics, logger log.Logger, ...) error

+ type CompactorMetrics struct

+ ChunkRange prometheus.Histogram

+ ChunkSamples prometheus.Histogram

+ ChunkSize prometheus.Histogram

+ Duration prometheus.Histogram

+ OverlappingBlocks prometheus.Counter

+ PopulatingBlocks prometheus.Gauge

+ Ran prometheus.Counter

+ type DefaultBlockPopulator struct

+ func (c DefaultBlockPopulator) PopulateBlock(ctx context.Context, metrics *CompactorMetrics, logger log.Logger, ...) (err error)

type LeveledCompactor

+ func (c *LeveledCompactor) CompactWithBlockPopulator(dest string, dirs []string, open []*Block, blockPopulator BlockPopulator) (uid ulid.ULID, err error)

May 8, 2023 GO-2026-5264 +2 more

  GO-2026-5264: Prometheus: Remote read endpoint allows denial of service via crafted snappy payload in github.com/prometheus/prometheus

  GO-2026-5381: Prometheus vulnerable to stored XSS via crafted histogram bucket label values in the old web UI heatmap display in github.com/prometheus/prometheus

  GO-2026-5662: Prometheus has Stored XSS via metric names and label values in Prometheus web UI in github.com/prometheus/prometheus

May 3, 2023 GO-2026-5264 +2 more

  GO-2026-5264: Prometheus: Remote read endpoint allows denial of service via crafted snappy payload in github.com/prometheus/prometheus

  GO-2026-5381: Prometheus vulnerable to stored XSS via crafted histogram bucket label values in the old web UI heatmap display in github.com/prometheus/prometheus

  GO-2026-5662: Prometheus has Stored XSS via metric names and label values in Prometheus web UI in github.com/prometheus/prometheus

Apr 26, 2023 GO-2026-5264 +2 more

  GO-2026-5264: Prometheus: Remote read endpoint allows denial of service via crafted snappy payload in github.com/prometheus/prometheus

  GO-2026-5381: Prometheus vulnerable to stored XSS via crafted histogram bucket label values in the old web UI heatmap display in github.com/prometheus/prometheus

  GO-2026-5662: Prometheus has Stored XSS via metric names and label values in Prometheus web UI in github.com/prometheus/prometheus

May 4, 2023 GO-2026-5264 +2 more

  GO-2026-5264: Prometheus: Remote read endpoint allows denial of service via crafted snappy payload in github.com/prometheus/prometheus

  GO-2026-5381: Prometheus vulnerable to stored XSS via crafted histogram bucket label values in the old web UI heatmap display in github.com/prometheus/prometheus

  GO-2026-5662: Prometheus has Stored XSS via metric names and label values in Prometheus web UI in github.com/prometheus/prometheus

Mar 21, 2023 GO-2026-5264 +2 more

  GO-2026-5264: Prometheus: Remote read endpoint allows denial of service via crafted snappy payload in github.com/prometheus/prometheus

  GO-2026-5381: Prometheus vulnerable to stored XSS via crafted histogram bucket label values in the old web UI heatmap display in github.com/prometheus/prometheus

  GO-2026-5662: Prometheus has Stored XSS via metric names and label values in Prometheus web UI in github.com/prometheus/prometheus

Changes in this version

type HeadOptions

+ WALReplayConcurrency int

type Options

+ WALReplayConcurrency int

Mar 16, 2023 GO-2026-5264 +2 more

  GO-2026-5264: Prometheus: Remote read endpoint allows denial of service via crafted snappy payload in github.com/prometheus/prometheus

  GO-2026-5381: Prometheus vulnerable to stored XSS via crafted histogram bucket label values in the old web UI heatmap display in github.com/prometheus/prometheus

  GO-2026-5662: Prometheus has Stored XSS via metric names and label values in Prometheus web UI in github.com/prometheus/prometheus

Mar 9, 2023 GO-2026-5264 +2 more

  GO-2026-5264: Prometheus: Remote read endpoint allows denial of service via crafted snappy payload in github.com/prometheus/prometheus

  GO-2026-5381: Prometheus vulnerable to stored XSS via crafted histogram bucket label values in the old web UI heatmap display in github.com/prometheus/prometheus

  GO-2026-5662: Prometheus has Stored XSS via metric names and label values in Prometheus web UI in github.com/prometheus/prometheus

Jan 31, 2023 GO-2026-5264 +2 more

  GO-2026-5264: Prometheus: Remote read endpoint allows denial of service via crafted snappy payload in github.com/prometheus/prometheus

  GO-2026-5381: Prometheus vulnerable to stored XSS via crafted histogram bucket label values in the old web UI heatmap display in github.com/prometheus/prometheus

  GO-2026-5662: Prometheus has Stored XSS via metric names and label values in Prometheus web UI in github.com/prometheus/prometheus

Changes in this version

+ func GenerateTestFloatHistograms(n int) (r []*histogram.FloatHistogram)

+ func GenerateTestGaugeFloatHistograms(n int) (r []*histogram.FloatHistogram)

+ func GenerateTestGaugeHistograms(n int) (r []*histogram.Histogram)

+ func ValidateFloatHistogram(h *histogram.FloatHistogram) error

Dec 20, 2022 GO-2026-5264 +2 more

  GO-2026-5264: Prometheus: Remote read endpoint allows denial of service via crafted snappy payload in github.com/prometheus/prometheus

  GO-2026-5381: Prometheus vulnerable to stored XSS via crafted histogram bucket label values in the old web UI heatmap display in github.com/prometheus/prometheus

  GO-2026-5662: Prometheus has Stored XSS via metric names and label values in Prometheus web UI in github.com/prometheus/prometheus

Dec 15, 2022 GO-2026-5264 +2 more

  GO-2026-5264: Prometheus: Remote read endpoint allows denial of service via crafted snappy payload in github.com/prometheus/prometheus

  GO-2026-5381: Prometheus vulnerable to stored XSS via crafted histogram bucket label values in the old web UI heatmap display in github.com/prometheus/prometheus

  GO-2026-5662: Prometheus has Stored XSS via metric names and label values in Prometheus web UI in github.com/prometheus/prometheus

Dec 14, 2022 GO-2026-5264 +2 more

  GO-2026-5264: Prometheus: Remote read endpoint allows denial of service via crafted snappy payload in github.com/prometheus/prometheus

  GO-2026-5381: Prometheus vulnerable to stored XSS via crafted histogram bucket label values in the old web UI heatmap display in github.com/prometheus/prometheus

  GO-2026-5662: Prometheus has Stored XSS via metric names and label values in Prometheus web UI in github.com/prometheus/prometheus

Dec 9, 2022 GO-2026-5264 +2 more

  GO-2026-5264: Prometheus: Remote read endpoint allows denial of service via crafted snappy payload in github.com/prometheus/prometheus

  GO-2026-5381: Prometheus vulnerable to stored XSS via crafted histogram bucket label values in the old web UI heatmap display in github.com/prometheus/prometheus

  GO-2026-5662: Prometheus has Stored XSS via metric names and label values in Prometheus web UI in github.com/prometheus/prometheus

Dec 1, 2022 GO-2026-5264 +2 more

  GO-2026-5264: Prometheus: Remote read endpoint allows denial of service via crafted snappy payload in github.com/prometheus/prometheus

  GO-2026-5381: Prometheus vulnerable to stored XSS via crafted histogram bucket label values in the old web UI heatmap display in github.com/prometheus/prometheus

  GO-2026-5662: Prometheus has Stored XSS via metric names and label values in Prometheus web UI in github.com/prometheus/prometheus

Nov 29, 2022 GO-2026-5264 +2 more

  GO-2026-5264: Prometheus: Remote read endpoint allows denial of service via crafted snappy payload in github.com/prometheus/prometheus

  GO-2026-5381: Prometheus vulnerable to stored XSS via crafted histogram bucket label values in the old web UI heatmap display in github.com/prometheus/prometheus

  GO-2026-5662: Prometheus has Stored XSS via metric names and label values in Prometheus web UI in github.com/prometheus/prometheus

Nov 24, 2022 GO-2026-5264 +2 more

  GO-2026-5264: Prometheus: Remote read endpoint allows denial of service via crafted snappy payload in github.com/prometheus/prometheus

  GO-2026-5381: Prometheus vulnerable to stored XSS via crafted histogram bucket label values in the old web UI heatmap display in github.com/prometheus/prometheus

  GO-2026-5662: Prometheus has Stored XSS via metric names and label values in Prometheus web UI in github.com/prometheus/prometheus

Nov 17, 2022 GO-2026-5264 +2 more

  GO-2026-5264: Prometheus: Remote read endpoint allows denial of service via crafted snappy payload in github.com/prometheus/prometheus

  GO-2026-5381: Prometheus vulnerable to stored XSS via crafted histogram bucket label values in the old web UI heatmap display in github.com/prometheus/prometheus

  GO-2026-5662: Prometheus has Stored XSS via metric names and label values in Prometheus web UI in github.com/prometheus/prometheus

Nov 9, 2022 GO-2026-5264 +2 more

  GO-2026-5264: Prometheus: Remote read endpoint allows denial of service via crafted snappy payload in github.com/prometheus/prometheus

  GO-2026-5381: Prometheus vulnerable to stored XSS via crafted histogram bucket label values in the old web UI heatmap display in github.com/prometheus/prometheus

  GO-2026-5662: Prometheus has Stored XSS via metric names and label values in Prometheus web UI in github.com/prometheus/prometheus

Nov 7, 2022 GO-2026-5264 +2 more

  GO-2026-5264: Prometheus: Remote read endpoint allows denial of service via crafted snappy payload in github.com/prometheus/prometheus

  GO-2026-5381: Prometheus vulnerable to stored XSS via crafted histogram bucket label values in the old web UI heatmap display in github.com/prometheus/prometheus

  GO-2026-5662: Prometheus has Stored XSS via metric names and label values in Prometheus web UI in github.com/prometheus/prometheus

Changes in this version

+ func GenerateTestHistograms(n int) (r []*histogram.Histogram)

+ func ValidateHistogram(h *histogram.Histogram) error

type DB

+ func (db *DB) DisableNativeHistograms()

+ func (db *DB) EnableNativeHistograms()

type DeletedIterator

+ func (it *DeletedIterator) AtFloatHistogram() (int64, *histogram.FloatHistogram)

+ func (it *DeletedIterator) AtHistogram() (int64, *histogram.Histogram)

+ func (it *DeletedIterator) AtT() int64

type Head

+ func (h *Head) DisableNativeHistograms()

+ func (h *Head) EnableNativeHistograms()

type HeadOptions

+ EnableNativeHistograms atomic.Bool

type Options

+ EnableNativeHistograms bool

Nov 3, 2022 GO-2026-5264 +2 more

  GO-2026-5264: Prometheus: Remote read endpoint allows denial of service via crafted snappy payload in github.com/prometheus/prometheus

  GO-2026-5381: Prometheus vulnerable to stored XSS via crafted histogram bucket label values in the old web UI heatmap display in github.com/prometheus/prometheus

  GO-2026-5662: Prometheus has Stored XSS via metric names and label values in Prometheus web UI in github.com/prometheus/prometheus

Nov 9, 2022 GO-2026-5264 +2 more

  GO-2026-5264: Prometheus: Remote read endpoint allows denial of service via crafted snappy payload in github.com/prometheus/prometheus

  GO-2026-5381: Prometheus vulnerable to stored XSS via crafted histogram bucket label values in the old web UI heatmap display in github.com/prometheus/prometheus

  GO-2026-5662: Prometheus has Stored XSS via metric names and label values in Prometheus web UI in github.com/prometheus/prometheus

Oct 7, 2022 GO-2026-5264 +2 more

  GO-2026-5264: Prometheus: Remote read endpoint allows denial of service via crafted snappy payload in github.com/prometheus/prometheus

  GO-2026-5381: Prometheus vulnerable to stored XSS via crafted histogram bucket label values in the old web UI heatmap display in github.com/prometheus/prometheus

  GO-2026-5662: Prometheus has Stored XSS via metric names and label values in Prometheus web UI in github.com/prometheus/prometheus

Oct 5, 2022 GO-2026-5264 +2 more

  GO-2026-5264: Prometheus: Remote read endpoint allows denial of service via crafted snappy payload in github.com/prometheus/prometheus

  GO-2026-5381: Prometheus vulnerable to stored XSS via crafted histogram bucket label values in the old web UI heatmap display in github.com/prometheus/prometheus

  GO-2026-5662: Prometheus has Stored XSS via metric names and label values in Prometheus web UI in github.com/prometheus/prometheus

Changes in this version

+ const CompactionHintFromOutOfOrder

+ const DefaultOutOfOrderCapMax

type BlockMetaCompaction

+ Hints []string

+ func (bm *BlockMetaCompaction) FromOutOfOrder() bool

+ func (bm *BlockMetaCompaction) SetOutOfOrder()

type DB

+ func (db *DB) CompactOOOHead() error

type Head

+ func (h *Head) MaxOOOTime() int64

+ func (h *Head) MinOOOTime() int64

+ func (h *Head) SetOutOfOrderTimeWindow(oooTimeWindow int64, wbl *wal.WAL)

type HeadOptions

+ OutOfOrderCapMax atomic.Int64

+ OutOfOrderTimeWindow atomic.Int64

type IndexReader

+ func NewOOOCompactionHeadIndexReader(ch *OOOCompactionHead) IndexReader

+ type OOOChunk struct

+ func NewOOOChunk() *OOOChunk

+ func (o *OOOChunk) Insert(t int64, v float64) bool

+ func (o *OOOChunk) NumSamples() int

+ func (o *OOOChunk) ToXOR() (*chunkenc.XORChunk, error)

+ func (o *OOOChunk) ToXORBetweenTimestamps(mint, maxt int64) (*chunkenc.XORChunk, error)

+ type OOOCompactionHead struct

+ func NewOOOCompactionHead(head *Head) (*OOOCompactionHead, error)

+ func (ch *OOOCompactionHead) ChunkRange() int64

+ func (ch *OOOCompactionHead) Chunks() (ChunkReader, error)

+ func (ch *OOOCompactionHead) CloneForTimeRange(mint, maxt int64) *OOOCompactionHead

+ func (ch *OOOCompactionHead) Index() (IndexReader, error)

+ func (ch *OOOCompactionHead) LastMmapRef() chunks.ChunkDiskMapperRef

+ func (ch *OOOCompactionHead) LastWBLFile() int

+ func (ch *OOOCompactionHead) MaxTime() int64

+ func (ch *OOOCompactionHead) Meta() BlockMeta

+ func (ch *OOOCompactionHead) MinTime() int64

+ func (ch *OOOCompactionHead) Size() int64

+ func (ch *OOOCompactionHead) Tombstones() (tombstones.Reader, error)

+ type OOOCompactionHeadIndexReader struct

+ func (ir *OOOCompactionHeadIndexReader) Close() error

+ func (ir *OOOCompactionHeadIndexReader) LabelNames(matchers ...*labels.Matcher) ([]string, error)

+ func (ir *OOOCompactionHeadIndexReader) LabelNamesFor(ids ...storage.SeriesRef) ([]string, error)

+ func (ir *OOOCompactionHeadIndexReader) LabelValueFor(id storage.SeriesRef, label string) (string, error)

+ func (ir *OOOCompactionHeadIndexReader) LabelValues(name string, matchers ...*labels.Matcher) ([]string, error)

+ func (ir *OOOCompactionHeadIndexReader) Postings(name string, values ...string) (index.Postings, error)

+ func (ir *OOOCompactionHeadIndexReader) PostingsForMatchers(concurrent bool, ms ...*labels.Matcher) (index.Postings, error)

+ func (ir *OOOCompactionHeadIndexReader) Series(ref storage.SeriesRef, lset *labels.Labels, chks *[]chunks.Meta) error

+ func (ir *OOOCompactionHeadIndexReader) SortedLabelValues(name string, matchers ...*labels.Matcher) ([]string, error)

+ func (ir *OOOCompactionHeadIndexReader) SortedPostings(p index.Postings) index.Postings

+ func (ir *OOOCompactionHeadIndexReader) Symbols() index.StringIter

+ type OOOHeadChunkReader struct

+ func NewOOOHeadChunkReader(head *Head, mint, maxt int64) *OOOHeadChunkReader

+ func (cr OOOHeadChunkReader) Chunk(meta chunks.Meta) (chunkenc.Chunk, error)

+ func (cr OOOHeadChunkReader) Close() error

+ type OOOHeadIndexReader struct

+ func NewOOOHeadIndexReader(head *Head, mint, maxt int64) *OOOHeadIndexReader

+ func (h OOOHeadIndexReader) Close() error

+ func (h OOOHeadIndexReader) LabelNames(matchers ...*labels.Matcher) ([]string, error)

+ func (h OOOHeadIndexReader) LabelNamesFor(ids ...storage.SeriesRef) ([]string, error)

+ func (h OOOHeadIndexReader) LabelValueFor(id storage.SeriesRef, label string) (string, error)

+ func (h OOOHeadIndexReader) SortedLabelValues(name string, matchers ...*labels.Matcher) ([]string, error)

+ func (h OOOHeadIndexReader) SortedPostings(p index.Postings) index.Postings

+ func (h OOOHeadIndexReader) Symbols() index.StringIter

+ func (oh *OOOHeadIndexReader) LabelValues(name string, matchers ...*labels.Matcher) ([]string, error)

+ func (oh *OOOHeadIndexReader) Postings(name string, values ...string) (index.Postings, error)

+ func (oh *OOOHeadIndexReader) Series(ref storage.SeriesRef, lbls *labels.Labels, chks *[]chunks.Meta) error

+ type OOORangeHead struct

+ func NewOOORangeHead(head *Head, mint, maxt int64) *OOORangeHead

+ func (oh *OOORangeHead) Chunks() (ChunkReader, error)

+ func (oh *OOORangeHead) Index() (IndexReader, error)

+ func (oh *OOORangeHead) MaxTime() int64

+ func (oh *OOORangeHead) Meta() BlockMeta

+ func (oh *OOORangeHead) MinTime() int64

+ func (oh *OOORangeHead) Size() int64

+ func (oh *OOORangeHead) String() string

+ func (oh *OOORangeHead) Tombstones() (tombstones.Reader, error)

type Options

+ AllowOverlappingCompaction bool

+ OutOfOrderCapMax int64

+ OutOfOrderTimeWindow int64

Aug 16, 2022 GO-2026-5264 +2 more

  GO-2026-5264: Prometheus: Remote read endpoint allows denial of service via crafted snappy payload in github.com/prometheus/prometheus

  GO-2026-5381: Prometheus vulnerable to stored XSS via crafted histogram bucket label values in the old web UI heatmap display in github.com/prometheus/prometheus

  GO-2026-5662: Prometheus has Stored XSS via metric names and label values in Prometheus web UI in github.com/prometheus/prometheus

Aug 11, 2022 GO-2026-5264 +2 more

  GO-2026-5264: Prometheus: Remote read endpoint allows denial of service via crafted snappy payload in github.com/prometheus/prometheus

  GO-2026-5381: Prometheus vulnerable to stored XSS via crafted histogram bucket label values in the old web UI heatmap display in github.com/prometheus/prometheus

  GO-2026-5662: Prometheus has Stored XSS via metric names and label values in Prometheus web UI in github.com/prometheus/prometheus

Jul 28, 2023 GO-2026-5264 +2 more

  GO-2026-5264: Prometheus: Remote read endpoint allows denial of service via crafted snappy payload in github.com/prometheus/prometheus

  GO-2026-5381: Prometheus vulnerable to stored XSS via crafted histogram bucket label values in the old web UI heatmap display in github.com/prometheus/prometheus

  GO-2026-5662: Prometheus has Stored XSS via metric names and label values in Prometheus web UI in github.com/prometheus/prometheus

May 5, 2023 GO-2026-5264 +2 more

  GO-2026-5264: Prometheus: Remote read endpoint allows denial of service via crafted snappy payload in github.com/prometheus/prometheus

  GO-2026-5381: Prometheus vulnerable to stored XSS via crafted histogram bucket label values in the old web UI heatmap display in github.com/prometheus/prometheus

  GO-2026-5662: Prometheus has Stored XSS via metric names and label values in Prometheus web UI in github.com/prometheus/prometheus

Apr 27, 2023 GO-2026-5264 +2 more

  GO-2026-5264: Prometheus: Remote read endpoint allows denial of service via crafted snappy payload in github.com/prometheus/prometheus

  GO-2026-5381: Prometheus vulnerable to stored XSS via crafted histogram bucket label values in the old web UI heatmap display in github.com/prometheus/prometheus

  GO-2026-5662: Prometheus has Stored XSS via metric names and label values in Prometheus web UI in github.com/prometheus/prometheus

Feb 20, 2023 GO-2026-5264 +2 more

  GO-2026-5264: Prometheus: Remote read endpoint allows denial of service via crafted snappy payload in github.com/prometheus/prometheus

  GO-2026-5381: Prometheus vulnerable to stored XSS via crafted histogram bucket label values in the old web UI heatmap display in github.com/prometheus/prometheus

  GO-2026-5662: Prometheus has Stored XSS via metric names and label values in Prometheus web UI in github.com/prometheus/prometheus

Dec 9, 2022 GO-2026-5264 +2 more

  GO-2026-5264: Prometheus: Remote read endpoint allows denial of service via crafted snappy payload in github.com/prometheus/prometheus

  GO-2026-5381: Prometheus vulnerable to stored XSS via crafted histogram bucket label values in the old web UI heatmap display in github.com/prometheus/prometheus

  GO-2026-5662: Prometheus has Stored XSS via metric names and label values in Prometheus web UI in github.com/prometheus/prometheus

Nov 29, 2022 GO-2026-5264 +2 more

  GO-2026-5264: Prometheus: Remote read endpoint allows denial of service via crafted snappy payload in github.com/prometheus/prometheus

  GO-2026-5381: Prometheus vulnerable to stored XSS via crafted histogram bucket label values in the old web UI heatmap display in github.com/prometheus/prometheus

  GO-2026-5662: Prometheus has Stored XSS via metric names and label values in Prometheus web UI in github.com/prometheus/prometheus

Nov 23, 2022 GO-2026-5264 +2 more

  GO-2026-5264: Prometheus: Remote read endpoint allows denial of service via crafted snappy payload in github.com/prometheus/prometheus

  GO-2026-5381: Prometheus vulnerable to stored XSS via crafted histogram bucket label values in the old web UI heatmap display in github.com/prometheus/prometheus

  GO-2026-5662: Prometheus has Stored XSS via metric names and label values in Prometheus web UI in github.com/prometheus/prometheus

Changes in this version

type Head

+ func (h *Head) WaitForAppendersOverlapping(maxt int64)

type RangeHead

+ func NewRangeHeadWithIsolationDisabled(head *Head, mint, maxt int64) *RangeHead

Nov 4, 2022 GO-2026-5264 +2 more

  GO-2026-5264: Prometheus: Remote read endpoint allows denial of service via crafted snappy payload in github.com/prometheus/prometheus

  GO-2026-5381: Prometheus vulnerable to stored XSS via crafted histogram bucket label values in the old web UI heatmap display in github.com/prometheus/prometheus

  GO-2026-5662: Prometheus has Stored XSS via metric names and label values in Prometheus web UI in github.com/prometheus/prometheus

Sep 12, 2022 GO-2026-5264 +2 more

  GO-2026-5264: Prometheus: Remote read endpoint allows denial of service via crafted snappy payload in github.com/prometheus/prometheus

  GO-2026-5381: Prometheus vulnerable to stored XSS via crafted histogram bucket label values in the old web UI heatmap display in github.com/prometheus/prometheus

  GO-2026-5662: Prometheus has Stored XSS via metric names and label values in Prometheus web UI in github.com/prometheus/prometheus

Jul 14, 2022 GO-2026-5264 +2 more

  GO-2026-5264: Prometheus: Remote read endpoint allows denial of service via crafted snappy payload in github.com/prometheus/prometheus

  GO-2026-5381: Prometheus vulnerable to stored XSS via crafted histogram bucket label values in the old web UI heatmap display in github.com/prometheus/prometheus

  GO-2026-5662: Prometheus has Stored XSS via metric names and label values in Prometheus web UI in github.com/prometheus/prometheus

Jul 11, 2022 GO-2026-5264 +2 more

  GO-2026-5264: Prometheus: Remote read endpoint allows denial of service via crafted snappy payload in github.com/prometheus/prometheus

  GO-2026-5381: Prometheus vulnerable to stored XSS via crafted histogram bucket label values in the old web UI heatmap display in github.com/prometheus/prometheus

  GO-2026-5662: Prometheus has Stored XSS via metric names and label values in Prometheus web UI in github.com/prometheus/prometheus

Jul 5, 2022 GO-2026-5264 +2 more

  GO-2026-5264: Prometheus: Remote read endpoint allows denial of service via crafted snappy payload in github.com/prometheus/prometheus

  GO-2026-5381: Prometheus vulnerable to stored XSS via crafted histogram bucket label values in the old web UI heatmap display in github.com/prometheus/prometheus

  GO-2026-5662: Prometheus has Stored XSS via metric names and label values in Prometheus web UI in github.com/prometheus/prometheus

Jun 20, 2022 GO-2026-5264 +2 more

  GO-2026-5264: Prometheus: Remote read endpoint allows denial of service via crafted snappy payload in github.com/prometheus/prometheus

  GO-2026-5381: Prometheus vulnerable to stored XSS via crafted histogram bucket label values in the old web UI heatmap display in github.com/prometheus/prometheus

  GO-2026-5662: Prometheus has Stored XSS via metric names and label values in Prometheus web UI in github.com/prometheus/prometheus

Jun 9, 2022 GO-2026-5264 +2 more

  GO-2026-5264: Prometheus: Remote read endpoint allows denial of service via crafted snappy payload in github.com/prometheus/prometheus

  GO-2026-5381: Prometheus vulnerable to stored XSS via crafted histogram bucket label values in the old web UI heatmap display in github.com/prometheus/prometheus

  GO-2026-5662: Prometheus has Stored XSS via metric names and label values in Prometheus web UI in github.com/prometheus/prometheus

May 30, 2022 GO-2026-5264 +2 more

  GO-2026-5264: Prometheus: Remote read endpoint allows denial of service via crafted snappy payload in github.com/prometheus/prometheus

  GO-2026-5381: Prometheus vulnerable to stored XSS via crafted histogram bucket label values in the old web UI heatmap display in github.com/prometheus/prometheus

  GO-2026-5662: Prometheus has Stored XSS via metric names and label values in Prometheus web UI in github.com/prometheus/prometheus

May 25, 2022 GO-2026-5264 +2 more

  GO-2026-5264: Prometheus: Remote read endpoint allows denial of service via crafted snappy payload in github.com/prometheus/prometheus

  GO-2026-5381: Prometheus vulnerable to stored XSS via crafted histogram bucket label values in the old web UI heatmap display in github.com/prometheus/prometheus

  GO-2026-5662: Prometheus has Stored XSS via metric names and label values in Prometheus web UI in github.com/prometheus/prometheus

Apr 21, 2022 GO-2026-5264 +2 more

  GO-2026-5264: Prometheus: Remote read endpoint allows denial of service via crafted snappy payload in github.com/prometheus/prometheus

  GO-2026-5381: Prometheus vulnerable to stored XSS via crafted histogram bucket label values in the old web UI heatmap display in github.com/prometheus/prometheus

  GO-2026-5662: Prometheus has Stored XSS via metric names and label values in Prometheus web UI in github.com/prometheus/prometheus

Changes in this version

+ const DefaultBlockDuration

+ const DefaultStripeSize

+ const WALFormatDefault

+ const WALMagic

+ var ErrAppenderClosed = errors.New("appender closed")

+ var ErrClosed = errors.New("db already closed")

+ var ErrClosing = errors.New("block is closing")

+ var ErrInvalidExemplar = errors.New("invalid exemplar")

+ var ErrInvalidSample = errors.New("invalid sample")

+ var ErrInvalidTimes = fmt.Errorf("max time is lesser than min time")

+ var ErrNoSeriesAppended error = errors.New("no series appended, aborting")

+ var ErrNotReady = errors.New("TSDB not ready")

+ func BeyondSizeRetention(db *DB, blocks []*Block) (deletable map[ulid.ULID]struct{})

+ func BeyondTimeRetention(db *DB, blocks []*Block) (deletable map[ulid.ULID]struct{})

+ func CreateBlock(series []storage.Series, dir string, chunkRange int64, logger log.Logger) (string, error)

+ func DeleteChunkSnapshots(dir string, maxIndex, maxOffset int) error

+ func ExponentialBlockRanges(minSize int64, steps, stepSize int) []int64

+ func LastChunkSnapshot(dir string) (string, int, int, error)

+ func MigrateWAL(logger log.Logger, dir string) (err error)

+ func NewBlockChunkQuerier(b BlockReader, mint, maxt int64) (storage.ChunkQuerier, error)

+ func NewBlockQuerier(b BlockReader, mint, maxt int64) (storage.Querier, error)

+ func NewMergedStringIter(a, b index.StringIter) index.StringIter

+ func PostingsForMatchers(ix IndexReader, ms ...*labels.Matcher) (index.Postings, error)

+ type Block struct

+ func OpenBlock(logger log.Logger, dir string, pool chunkenc.Pool) (pb *Block, err error)

+ func (pb *Block) Chunks() (ChunkReader, error)

+ func (pb *Block) CleanTombstones(dest string, c Compactor) (*ulid.ULID, bool, error)

+ func (pb *Block) Close() error

+ func (pb *Block) Delete(mint, maxt int64, ms ...*labels.Matcher) error

+ func (pb *Block) Dir() string

+ func (pb *Block) GetSymbolTableSize() uint64

+ func (pb *Block) Index() (IndexReader, error)

+ func (pb *Block) LabelNames() ([]string, error)

+ func (pb *Block) MaxTime() int64

+ func (pb *Block) Meta() BlockMeta

+ func (pb *Block) MinTime() int64

+ func (pb *Block) OverlapsClosedInterval(mint, maxt int64) bool

+ func (pb *Block) Size() int64

+ func (pb *Block) Snapshot(dir string) error

+ func (pb *Block) String() string

+ func (pb *Block) Tombstones() (tombstones.Reader, error)

+ type BlockDesc struct

+ MaxTime int64

+ MinTime int64

+ ULID ulid.ULID

+ type BlockMeta struct

+ Compaction BlockMetaCompaction

+ MaxTime int64

+ MinTime int64

+ Stats BlockStats

+ ULID ulid.ULID

+ Version int

+ func CompactBlockMetas(uid ulid.ULID, blocks ...*BlockMeta) *BlockMeta

+ type BlockMetaCompaction struct

+ Deletable bool

+ Failed bool

+ Level int

+ Parents []BlockDesc

+ Sources []ulid.ULID

+ type BlockReader interface

+ Chunks func() (ChunkReader, error)

+ Index func() (IndexReader, error)

+ Meta func() BlockMeta

+ Size func() int64

+ Tombstones func() (tombstones.Reader, error)

+ type BlockStats struct

+ NumChunks uint64

+ NumSamples uint64

+ NumSeries uint64

+ NumTombstones uint64

+ type BlockWriter struct

+ func NewBlockWriter(logger log.Logger, dir string, blockSize int64) (*BlockWriter, error)

+ func (w *BlockWriter) Appender(ctx context.Context) storage.Appender

+ func (w *BlockWriter) Close() error

+ func (w *BlockWriter) Flush(ctx context.Context) (ulid.ULID, error)

+ type BlocksToDeleteFunc func(blocks []*Block) map[ulid.ULID]struct

+ func DefaultBlocksToDelete(db *DB) BlocksToDeleteFunc

+ type ChunkReader interface

+ Chunk func(ref chunks.ChunkRef) (chunkenc.Chunk, error)

+ Close func() error

+ type ChunkSnapshotStats struct

+ Dir string

+ TotalSeries int

+ type ChunkWriter interface

+ Close func() error

+ WriteChunks func(chunks ...chunks.Meta) error

+ type CircularExemplarStorage struct

+ func (ce *CircularExemplarStorage) AddExemplar(l labels.Labels, e exemplar.Exemplar) error

+ func (ce *CircularExemplarStorage) Appender() *CircularExemplarStorage

+ func (ce *CircularExemplarStorage) ApplyConfig(cfg *config.Config) error

+ func (ce *CircularExemplarStorage) ExemplarQuerier(_ context.Context) (storage.ExemplarQuerier, error)

+ func (ce *CircularExemplarStorage) IterateExemplars(f func(seriesLabels labels.Labels, e exemplar.Exemplar) error) error

+ func (ce *CircularExemplarStorage) Querier(_ context.Context) (storage.ExemplarQuerier, error)

+ func (ce *CircularExemplarStorage) Resize(l int64) int

+ func (ce *CircularExemplarStorage) Select(start, end int64, matchers ...[]*labels.Matcher) ([]exemplar.QueryResult, error)

+ func (ce *CircularExemplarStorage) ValidateExemplar(l labels.Labels, e exemplar.Exemplar) error

+ type Compactor interface

+ Compact func(dest string, dirs []string, open []*Block) (ulid.ULID, error)

+ Plan func(dir string) ([]string, error)

+ Write func(dest string, b BlockReader, mint, maxt int64, parent *BlockMeta) (ulid.ULID, error)

+ type DB struct

+ func Open(dir string, l log.Logger, r prometheus.Registerer, opts *Options, ...) (db *DB, err error)

+ func (db *DB) Appender(ctx context.Context) storage.Appender

+ func (db *DB) ApplyConfig(conf *config.Config) error

+ func (db *DB) Blocks() []*Block

+ func (db *DB) ChunkQuerier(_ context.Context, mint, maxt int64) (storage.ChunkQuerier, error)

+ func (db *DB) CleanTombstones() (err error)

+ func (db *DB) Close() error

+ func (db *DB) Compact() (returnErr error)

+ func (db *DB) CompactHead(head *RangeHead) error

+ func (db *DB) Delete(mint, maxt int64, ms ...*labels.Matcher) error

+ func (db *DB) Dir() string

+ func (db *DB) DisableCompactions()

+ func (db *DB) EnableCompactions()

+ func (db *DB) ExemplarQuerier(ctx context.Context) (storage.ExemplarQuerier, error)

+ func (db *DB) Head() *Head

+ func (db *DB) Querier(_ context.Context, mint, maxt int64) (storage.Querier, error)

+ func (db *DB) Snapshot(dir string, withHead bool) error

+ func (db *DB) StartTime() (int64, error)

+ func (db *DB) String() string

+ type DBReadOnly struct

+ func OpenDBReadOnly(dir string, l log.Logger) (*DBReadOnly, error)

+ func (db *DBReadOnly) Blocks() ([]BlockReader, error)

+ func (db *DBReadOnly) ChunkQuerier(ctx context.Context, mint, maxt int64) (storage.ChunkQuerier, error)

+ func (db *DBReadOnly) Close() error

+ func (db *DBReadOnly) FlushWAL(dir string) (returnErr error)

+ func (db *DBReadOnly) Querier(ctx context.Context, mint, maxt int64) (storage.Querier, error)

+ type DBStats struct

+ Head *HeadStats

+ func NewDBStats() *DBStats

+ type DeletedIterator struct

+ Intervals tombstones.Intervals

+ Iter chunkenc.Iterator

+ func (it *DeletedIterator) At() (int64, float64)

+ func (it *DeletedIterator) Err() error

+ func (it *DeletedIterator) Next() bool

+ func (it *DeletedIterator) Seek(t int64) bool

+ type ExemplarMetrics struct

+ func NewExemplarMetrics(reg prometheus.Registerer) *ExemplarMetrics

+ type ExemplarStorage interface

+ AddExemplar func(labels.Labels, exemplar.Exemplar) error

+ IterateExemplars func(f func(seriesLabels labels.Labels, e exemplar.Exemplar) error) error

+ ValidateExemplar func(labels.Labels, exemplar.Exemplar) error

+ func NewCircularExemplarStorage(len int64, m *ExemplarMetrics) (ExemplarStorage, error)

+ type Head struct

+ func NewHead(r prometheus.Registerer, l log.Logger, wal *wal.WAL, opts *HeadOptions, ...) (*Head, error)

+ func (h *Head) AppendableMinValidTime() (int64, bool)

+ func (h *Head) Appender(_ context.Context) storage.Appender

+ func (h *Head) ApplyConfig(cfg *config.Config) error

+ func (h *Head) ChunkSnapshot() (*ChunkSnapshotStats, error)

+ func (h *Head) Chunks() (ChunkReader, error)

+ func (h *Head) Close() error

+ func (h *Head) Delete(mint, maxt int64, ms ...*labels.Matcher) error

+ func (h *Head) ExemplarQuerier(ctx context.Context) (storage.ExemplarQuerier, error)

+ func (h *Head) Index() (IndexReader, error)

+ func (h *Head) Init(minValidTime int64) error

+ func (h *Head) IsQuerierCollidingWithTruncation(querierMint, querierMaxt int64) (shouldClose, getNew bool, newMint int64)

+ func (h *Head) MaxTime() int64

+ func (h *Head) Meta() BlockMeta

+ func (h *Head) MinTime() int64

+ func (h *Head) NumSeries() uint64

+ func (h *Head) OverlapsClosedInterval(mint, maxt int64) bool

+ func (h *Head) PostingsCardinalityStats(statsByLabelName string) *index.PostingsStats

+ func (h *Head) SetMinValidTime(minValidTime int64)

+ func (h *Head) Size() int64

+ func (h *Head) Stats(statsByLabelName string) *Stats

+ func (h *Head) String() string

+ func (h *Head) Tombstones() (tombstones.Reader, error)

+ func (h *Head) Truncate(mint int64) (err error)

+ func (h *Head) WaitForPendingReadersInTimeRange(mint, maxt int64)

+ type HeadOptions struct

+ ChunkDirRoot string

+ ChunkPool chunkenc.Pool

+ ChunkRange int64

+ ChunkWriteBufferSize int

+ ChunkWriteQueueSize int

+ EnableExemplarStorage bool

+ EnableMemorySnapshotOnShutdown bool

+ IsolationDisabled bool

+ MaxExemplars atomic.Int64

+ SeriesCallback SeriesLifecycleCallback

+ StripeSize int

+ func DefaultHeadOptions() *HeadOptions

+ type HeadStats struct

+ WALReplayStatus *WALReplayStatus

+ func NewHeadStats() *HeadStats

+ type IndexReader interface

+ Close func() error

+ LabelNames func(matchers ...*labels.Matcher) ([]string, error)

+ LabelNamesFor func(ids ...storage.SeriesRef) ([]string, error)

+ LabelValueFor func(id storage.SeriesRef, label string) (string, error)

+ LabelValues func(name string, matchers ...*labels.Matcher) ([]string, error)

+ Postings func(name string, values ...string) (index.Postings, error)

+ Series func(ref storage.SeriesRef, lset *labels.Labels, chks *[]chunks.Meta) error

+ SortedLabelValues func(name string, matchers ...*labels.Matcher) ([]string, error)

+ SortedPostings func(index.Postings) index.Postings

+ Symbols func() index.StringIter

+ type IndexWriter interface

+ AddSeries func(ref storage.SeriesRef, l labels.Labels, chunks ...chunks.Meta) error

+ AddSymbol func(sym string) error

+ Close func() error

+ type LeveledCompactor struct

+ func NewLeveledCompactor(ctx context.Context, r prometheus.Registerer, l log.Logger, ranges []int64, ...) (*LeveledCompactor, error)

+ func NewLeveledCompactorWithChunkSize(ctx context.Context, r prometheus.Registerer, l log.Logger, ranges []int64, ...) (*LeveledCompactor, error)

+ func (c *LeveledCompactor) Compact(dest string, dirs []string, open []*Block) (uid ulid.ULID, err error)

+ func (c *LeveledCompactor) Plan(dir string) ([]string, error)

+ func (c *LeveledCompactor) Write(dest string, b BlockReader, mint, maxt int64, parent *BlockMeta) (ulid.ULID, error)

+ type Options struct

+ AllowOverlappingBlocks bool

+ BlocksToDelete BlocksToDeleteFunc

+ EnableExemplarStorage bool

+ EnableMemorySnapshotOnShutdown bool

+ HeadChunksWriteBufferSize int

+ HeadChunksWriteQueueSize int

+ IsolationDisabled bool

+ MaxBlockChunkSegmentSize int64

+ MaxBlockDuration int64

+ MaxBytes int64

+ MaxExemplars int64

+ MinBlockDuration int64

+ NoLockfile bool

+ RetentionDuration int64

+ SeriesLifecycleCallback SeriesLifecycleCallback

+ StripeSize int

+ WALCompression bool

+ WALSegmentSize int

+ func DefaultOptions() *Options

+ type Overlaps map[TimeRange][]BlockMeta

+ func OverlappingBlocks(bm []BlockMeta) Overlaps

+ func (o Overlaps) String() string

+ type RangeHead struct

+ func NewRangeHead(head *Head, mint, maxt int64) *RangeHead

+ func (h *RangeHead) BlockMaxTime() int64

+ func (h *RangeHead) Chunks() (ChunkReader, error)

+ func (h *RangeHead) Index() (IndexReader, error)

+ func (h *RangeHead) MaxTime() int64

+ func (h *RangeHead) Meta() BlockMeta

+ func (h *RangeHead) MinTime() int64

+ func (h *RangeHead) NumSeries() uint64

+ func (h *RangeHead) Size() int64

+ func (h *RangeHead) String() string

+ func (h *RangeHead) Tombstones() (tombstones.Reader, error)

+ type SegmentWAL struct

+ func OpenSegmentWAL(dir string, logger log.Logger, flushInterval time.Duration, ...) (*SegmentWAL, error)

+ func (w *SegmentWAL) Close() error

+ func (w *SegmentWAL) LogDeletes(stones []tombstones.Stone) error

+ func (w *SegmentWAL) LogSamples(samples []record.RefSample) error

+ func (w *SegmentWAL) LogSeries(series []record.RefSeries) error

+ func (w *SegmentWAL) Reader() WALReader

+ func (w *SegmentWAL) Sync() error

+ func (w *SegmentWAL) Truncate(mint int64, keep func(chunks.HeadSeriesRef) bool) error

+ type SeriesLifecycleCallback interface

+ PostCreation func(labels.Labels)

+ PostDeletion func(...labels.Labels)

+ PreCreation func(labels.Labels) error

+ type Stats struct

+ IndexPostingStats *index.PostingsStats

+ MaxTime int64

+ MinTime int64

+ NumSeries uint64

+ type TimeRange struct

+ Max int64

+ Min int64

+ type WAL interface

+ Close func() error

+ LogDeletes func([]tombstones.Stone) error

+ LogSamples func([]record.RefSample) error

+ LogSeries func([]record.RefSeries) error

+ Reader func() WALReader

+ Truncate func(mint int64, keep func(uint64) bool) error

+ type WALEntryType uint8

+ const WALEntryDeletes

+ const WALEntrySamples

+ const WALEntrySeries

+ const WALEntrySymbols

+ type WALReader interface

+ Read func(seriesf func([]record.RefSeries), samplesf func([]record.RefSample), ...) error

+ type WALReplayStatus struct

+ Current int

+ Max int

+ Min int

+ func (s *WALReplayStatus) GetWALReplayStatus() WALReplayStatus

Apr 14, 2022 GO-2026-5264 +2 more

  GO-2026-5264: Prometheus: Remote read endpoint allows denial of service via crafted snappy payload in github.com/prometheus/prometheus

  GO-2026-5381: Prometheus vulnerable to stored XSS via crafted histogram bucket label values in the old web UI heatmap display in github.com/prometheus/prometheus

  GO-2026-5662: Prometheus has Stored XSS via metric names and label values in Prometheus web UI in github.com/prometheus/prometheus