Prometheus Memory Exhaustion Vulnerability in Remote Read Endpoint Allowing Denial-of-Service

A denial-of-service vulnerability has been identified in Prometheus versions prior to 3.5.3 and 3.11.3. The issue arises in the remote read endpoint (/api/v1/read), which fails to validate the declared decoded length of snappy-compressed request bodies before memory allocation. This oversight allows an unauthenticated attacker to send a small payload that triggers a significant heap allocation with each request. Under concurrent load, this can deplete available memory and cause the Prometheus process to crash.

Impact

Exploitation of this vulnerability can lead to excessive memory consumption, causing the Prometheus process to crash.

Remediation

Users can upgrade to Prometheus versions 3.5.3 or 3.11.3. For those unable to upgrade, it is recommended to place Prometheus behind a reverse proxy or firewall that requires authentication before requests reach the /api/v1/read endpoint.