Affected by GO-2026-5264
and 3 other vulnerabilities
GO-2026-5264: Prometheus: Remote read endpoint allows denial of service via crafted snappy payload in github.com/prometheus/prometheus
GO-2026-5381: Prometheus vulnerable to stored XSS via crafted histogram bucket label values in the old web UI heatmap display in github.com/prometheus/prometheus
GO-2026-5662: Prometheus has Stored XSS via metric names and label values in Prometheus web UI in github.com/prometheus/prometheus
GO-2026-5710: Prometheus Azure AD remote write OAuth client secret exposed via config API in github.com/prometheus/prometheus
type Pool[T any] struct {
// contains filtered or unexported fields
}
Pool is a type-safe pool of items that does not allocate pointers to items.
That is not entirely true, it does allocate sometimes, but not most of the time,
just like the usual sync.Pool pools items most of the time, except when they're evicted.
It does that by storing the allocated pointers in a secondary pool instead of letting them go,
so they can be used later to store the items again.
Zero value of Pool[T] is valid, and it will return zero values of T if nothing is pooled.