Staging Environment: Content and features may be unstable or change without notice.
Search for vulnerabilities
Vulnerability details: VCID-h4am-zzay-w7cg
Vulnerability ID VCID-h4am-zzay-w7cg
Aliases CVE-2026-42154
GHSA-8rm2-7qqf-34qm
Summary
Status Published
Exploitability None
Weighted Severity None
Risk None
Affected and Fixed Packages Package Details
Weaknesses (2)
CWE-400 Uncontrolled Resource Consumption
CWE-789 Memory Allocation with Excessive Size Value
System Score Found at
epss 0.00021 https://api.first.org/data/v1/epss?cve=CVE-2026-42154
cvssv3.1 7.5 https://ftp.suse.com/pub/projects/security/yaml/suse-cvss-scores.yaml
cvssv3.1 7.5 https://github.com/prometheus/prometheus
generic_textual HIGH https://github.com/prometheus/prometheus
cvssv3.1 7.5 https://github.com/prometheus/prometheus/pull/18584
generic_textual HIGH https://github.com/prometheus/prometheus/pull/18584
ssvc Track https://github.com/prometheus/prometheus/pull/18584
cvssv3.1 7.5 https://github.com/prometheus/prometheus/pull/18585
generic_textual HIGH https://github.com/prometheus/prometheus/pull/18585
ssvc Track https://github.com/prometheus/prometheus/pull/18585
cvssv3.1 7.5 https://github.com/prometheus/prometheus/releases/tag/v3.11.3
generic_textual HIGH https://github.com/prometheus/prometheus/releases/tag/v3.11.3
ssvc Track https://github.com/prometheus/prometheus/releases/tag/v3.11.3
cvssv3.1 7.5 https://github.com/prometheus/prometheus/releases/tag/v3.5.3
generic_textual HIGH https://github.com/prometheus/prometheus/releases/tag/v3.5.3
ssvc Track https://github.com/prometheus/prometheus/releases/tag/v3.5.3
cvssv3.1 7.5 https://github.com/prometheus/prometheus/security/advisories/GHSA-8rm2-7qqf-34qm
generic_textual HIGH https://github.com/prometheus/prometheus/security/advisories/GHSA-8rm2-7qqf-34qm
ssvc Track https://github.com/prometheus/prometheus/security/advisories/GHSA-8rm2-7qqf-34qm
cvssv3.1 7.5 https://nvd.nist.gov/vuln/detail/CVE-2026-42154
generic_textual HIGH https://nvd.nist.gov/vuln/detail/CVE-2026-42154
Reference id Reference type URL
https://api.first.org/data/v1/epss?cve=CVE-2026-42154
https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-42154
https://ftp.suse.com/pub/projects/security/yaml/suse-cvss-scores.yaml
https://github.com/prometheus/prometheus
https://nvd.nist.gov/vuln/detail/CVE-2026-42154
18584 https://github.com/prometheus/prometheus/pull/18584
18585 https://github.com/prometheus/prometheus/pull/18585
GHSA-8rm2-7qqf-34qm https://github.com/prometheus/prometheus/security/advisories/GHSA-8rm2-7qqf-34qm
v3.11.3 https://github.com/prometheus/prometheus/releases/tag/v3.11.3
v3.5.3 https://github.com/prometheus/prometheus/releases/tag/v3.5.3
No exploits are available.
Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H Found at https://ftp.suse.com/pub/projects/security/yaml/suse-cvss-scores.yaml
Attack Vector (AV) Attack Complexity (AC) Privileges Required (PR) User Interaction (UI) Scope (S) Confidentiality Impact (C) Integrity Impact (I) Availability Impact (A)

network

adjacent_network

local

physical

low

high

none

low

high

none

required

unchanged

changed

high

low

none

high

low

none

high

low

none
Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H Found at https://github.com/prometheus/prometheus
Attack Vector (AV) Attack Complexity (AC) Privileges Required (PR) User Interaction (UI) Scope (S) Confidentiality Impact (C) Integrity Impact (I) Availability Impact (A)

network

adjacent_network

local

physical

low

high

none

low

high

none

required

unchanged

changed

high

low

none

high

low

none

high

low

none
Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H Found at https://github.com/prometheus/prometheus/pull/18584
Attack Vector (AV) Attack Complexity (AC) Privileges Required (PR) User Interaction (UI) Scope (S) Confidentiality Impact (C) Integrity Impact (I) Availability Impact (A)

network

adjacent_network

local

physical

low

high

none

low

high

none

required

unchanged

changed

high

low

none

high

low

none

high

low

none
Vector: SSVCv2/E:N/A:Y/T:P/P:M/B:A/M:M/D:T/2026-05-04T20:18:48Z/ Found at https://github.com/prometheus/prometheus/pull/18584
Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H Found at https://github.com/prometheus/prometheus/pull/18585
Attack Vector (AV) Attack Complexity (AC) Privileges Required (PR) User Interaction (UI) Scope (S) Confidentiality Impact (C) Integrity Impact (I) Availability Impact (A)

network

adjacent_network

local

physical

low

high

none

low

high

none

required

unchanged

changed

high

low

none

high

low

none

high

low

none
Vector: SSVCv2/E:N/A:Y/T:P/P:M/B:A/M:M/D:T/2026-05-04T20:18:48Z/ Found at https://github.com/prometheus/prometheus/pull/18585
Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H Found at https://github.com/prometheus/prometheus/releases/tag/v3.11.3
Attack Vector (AV) Attack Complexity (AC) Privileges Required (PR) User Interaction (UI) Scope (S) Confidentiality Impact (C) Integrity Impact (I) Availability Impact (A)

network

adjacent_network

local

physical

low

high

none

low

high

none

required

unchanged

changed

high

low

none

high

low

none

high

low

none
Vector: SSVCv2/E:N/A:Y/T:P/P:M/B:A/M:M/D:T/2026-05-04T20:18:48Z/ Found at https://github.com/prometheus/prometheus/releases/tag/v3.11.3
Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H Found at https://github.com/prometheus/prometheus/releases/tag/v3.5.3
Attack Vector (AV) Attack Complexity (AC) Privileges Required (PR) User Interaction (UI) Scope (S) Confidentiality Impact (C) Integrity Impact (I) Availability Impact (A)

network

adjacent_network

local

physical

low

high

none

low

high

none

required

unchanged

changed

high

low

none

high

low

none

high

low

none
Vector: SSVCv2/E:N/A:Y/T:P/P:M/B:A/M:M/D:T/2026-05-04T20:18:48Z/ Found at https://github.com/prometheus/prometheus/releases/tag/v3.5.3
Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H Found at https://github.com/prometheus/prometheus/security/advisories/GHSA-8rm2-7qqf-34qm
Attack Vector (AV) Attack Complexity (AC) Privileges Required (PR) User Interaction (UI) Scope (S) Confidentiality Impact (C) Integrity Impact (I) Availability Impact (A)

network

adjacent_network

local

physical

low

high

none

low

high

none

required

unchanged

changed

high

low

none

high

low

none

high

low

none
Vector: SSVCv2/E:N/A:Y/T:P/P:M/B:A/M:M/D:T/2026-05-04T20:18:48Z/ Found at https://github.com/prometheus/prometheus/security/advisories/GHSA-8rm2-7qqf-34qm
Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H Found at https://nvd.nist.gov/vuln/detail/CVE-2026-42154
Attack Vector (AV) Attack Complexity (AC) Privileges Required (PR) User Interaction (UI) Scope (S) Confidentiality Impact (C) Integrity Impact (I) Availability Impact (A)

network

adjacent_network

local

physical

low

high

none

low

high

none

required

unchanged

changed

high

low

none

high

low

none

high

low

none
Exploit Prediction Scoring System (EPSS)
Percentile 0.05785
EPSS Score 0.00021
Published At May 5, 2026, 12:55 p.m.
Date Actor Action Source VulnerableCode Version
2026-04-30T16:21:07.631418+00:00 Alpine Linux Importer Import https://secdb.alpinelinux.org/v3.23/community.json 38.5.0