{"schema_version":"1.7.5","id":"SUSE-SU-2026:1008-1","published":"2026-03-25T10:07:27Z","modified":"2026-03-26T09:00:27.331237Z","related":["CVE-2025-12816","CVE-2025-13465","CVE-2025-61140","CVE-2026-1615","CVE-2026-25547"],"upstream":["CVE-2025-12816","CVE-2025-13465","CVE-2025-61140","CVE-2026-1615","CVE-2026-25547"],"summary":"Security update for Prometheus ","details":"This update for Prometheus fixes the following issues:\n\ngolang-github-prometheus-alertmanager, golang-github-prometheus-node_exporter: \n\n- Internal changes to fix build issues with no impact for customers   \n\ngolang-github-prometheus-prometheus:\n\n- Security issues fixed:\n\n  * CVE-2026-27606: Fixed arbitrary file write via path traversal in rollup (bsc#1258893)\n  * CVE-2026-25547: Fixed unbounded brace range expansion leading to excessive CPU and memory consumption (bsc#1257841)\n  * CVE-2026-1615, CVE-2025-61140 The old web UI is no longer built due to security issues (bsc#1257897, bsc#1257442)\n  * CVE-2025-13465: Bump lodash package to version 4.17.23 to fix prototype pollution vulnerability (bsc#1257329)\n  * CVE-2025-12816: Interpretation conflict vulnerability allowing bypassing cryptographic verifications (bsc#1255588)\n\n- Version update from 2.53.4 to 3.5.0 with the following highlighted changes (jsc#PED-13824):\n\n  * Modernized Interface: Introduced a brand-new UI\n  * Enhanced Cloud and Auth: Added unified AWS service discovery (EC2, ECS, Lightsail) and Azure Workload Identity support\n    for more secure, native cloudauthentication.\n  * Performance Standards: Fully integrated OpenTelemetry (OTLP) ingestion and moved Native Histograms from experimental\n    to a stable feature.\n  * Advanced Data Export: Rolled out Remote Write 2.0, offering better performance and metadata handling when sending\n    data to external systems.\n  * Query Power: Added new PromQL functions (like first_over_time and last_over_time) and optimization for grouping\n    operations.\n  * Better Visibility: The UI now displays detailed relabeling steps, scrape intervals, and timeouts, making it easier\n    to troubleshoot why targets aren't reporting correctly.\n  * Critical Fixes: Resolved significant memory leaks related to query logging and fixed bugs where targets were\n    accidentally being scraped multiple times.\n","affected":[{"package":{"name":"golang-github-prometheus-alertmanager","ecosystem":"SUSE:Manager Client Tools 15","purl":"pkg:rpm/suse/golang-github-prometheus-alertmanager&distro=SUSE%20Manager%20Client%20Tools%2015"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.28.1-150100.4.31.1"}]}],"ecosystem_specific":{"binaries":[{"golang-github-prometheus-alertmanager":"0.28.1-150100.4.31.1"}]},"database_specific":{"source":"https://ftp.suse.com/pub/projects/security/osv/SUSE-SU-2026:1008-1.json"}},{"package":{"name":"golang-github-prometheus-node_exporter","ecosystem":"SUSE:Manager Client Tools for SLE Micro 5","purl":"pkg:rpm/suse/golang-github-prometheus-node_exporter&distro=SUSE%20Manager%20Client%20Tools%20for%20SLE%20Micro%205"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.9.1-150100.3.38.1"}]}],"ecosystem_specific":{"binaries":[{"golang-github-prometheus-node_exporter":"1.9.1-150100.3.38.1"}]},"database_specific":{"source":"https://ftp.suse.com/pub/projects/security/osv/SUSE-SU-2026:1008-1.json"}},{"package":{"name":"golang-github-prometheus-node_exporter","ecosystem":"SUSE:Linux Enterprise Module for Basesystem 15 SP7","purl":"pkg:rpm/suse/golang-github-prometheus-node_exporter&distro=SUSE%20Linux%20Enterprise%20Module%20for%20Basesystem%2015%20SP7"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.9.1-150100.3.38.1"}]}],"ecosystem_specific":{"binaries":[{"golang-github-prometheus-node_exporter":"1.9.1-150100.3.38.1"}]},"database_specific":{"source":"https://ftp.suse.com/pub/projects/security/osv/SUSE-SU-2026:1008-1.json"}},{"package":{"name":"golang-github-prometheus-alertmanager","ecosystem":"SUSE:Linux Enterprise Module for Package Hub 15 SP7","purl":"pkg:rpm/suse/golang-github-prometheus-alertmanager&distro=SUSE%20Linux%20Enterprise%20Module%20for%20Package%20Hub%2015%20SP7"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.28.1-150100.4.31.1"}]}],"ecosystem_specific":{"binaries":[{"golang-github-prometheus-alertmanager":"0.28.1-150100.4.31.1","golang-github-prometheus-prometheus":"3.5.0-150100.4.29.1"}]},"database_specific":{"source":"https://ftp.suse.com/pub/projects/security/osv/SUSE-SU-2026:1008-1.json"}},{"package":{"name":"golang-github-prometheus-prometheus","ecosystem":"SUSE:Linux Enterprise Module for Package Hub 15 SP7","purl":"pkg:rpm/suse/golang-github-prometheus-prometheus&distro=SUSE%20Linux%20Enterprise%20Module%20for%20Package%20Hub%2015%20SP7"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.5.0-150100.4.29.1"}]}],"ecosystem_specific":{"binaries":[{"golang-github-prometheus-alertmanager":"0.28.1-150100.4.31.1","golang-github-prometheus-prometheus":"3.5.0-150100.4.29.1"}]},"database_specific":{"source":"https://ftp.suse.com/pub/projects/security/osv/SUSE-SU-2026:1008-1.json"}},{"package":{"name":"golang-github-prometheus-node_exporter","ecosystem":"SUSE:Linux Enterprise High Performance Computing 15 SP4-ESPOS","purl":"pkg:rpm/suse/golang-github-prometheus-node_exporter&distro=SUSE%20Linux%20Enterprise%20High%20Performance%20Computing%2015%20SP4-ESPOS"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.9.1-150100.3.38.1"}]}],"ecosystem_specific":{"binaries":[{"golang-github-prometheus-node_exporter":"1.9.1-150100.3.38.1"}]},"database_specific":{"source":"https://ftp.suse.com/pub/projects/security/osv/SUSE-SU-2026:1008-1.json"}},{"package":{"name":"golang-github-prometheus-node_exporter","ecosystem":"SUSE:Linux Enterprise High Performance Computing 15 SP4-LTSS","purl":"pkg:rpm/suse/golang-github-prometheus-node_exporter&distro=SUSE%20Linux%20Enterprise%20High%20Performance%20Computing%2015%20SP4-LTSS"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.9.1-150100.3.38.1"}]}],"ecosystem_specific":{"binaries":[{"golang-github-prometheus-node_exporter":"1.9.1-150100.3.38.1"}]},"database_specific":{"source":"https://ftp.suse.com/pub/projects/security/osv/SUSE-SU-2026:1008-1.json"}},{"package":{"name":"golang-github-prometheus-node_exporter","ecosystem":"SUSE:Linux Enterprise High Performance Computing 15 SP5-ESPOS","purl":"pkg:rpm/suse/golang-github-prometheus-node_exporter&distro=SUSE%20Linux%20Enterprise%20High%20Performance%20Computing%2015%20SP5-ESPOS"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.9.1-150100.3.38.1"}]}],"ecosystem_specific":{"binaries":[{"golang-github-prometheus-node_exporter":"1.9.1-150100.3.38.1"}]},"database_specific":{"source":"https://ftp.suse.com/pub/projects/security/osv/SUSE-SU-2026:1008-1.json"}},{"package":{"name":"golang-github-prometheus-node_exporter","ecosystem":"SUSE:Linux Enterprise High Performance Computing 15 SP5-LTSS","purl":"pkg:rpm/suse/golang-github-prometheus-node_exporter&distro=SUSE%20Linux%20Enterprise%20High%20Performance%20Computing%2015%20SP5-LTSS"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.9.1-150100.3.38.1"}]}],"ecosystem_specific":{"binaries":[{"golang-github-prometheus-node_exporter":"1.9.1-150100.3.38.1"}]},"database_specific":{"source":"https://ftp.suse.com/pub/projects/security/osv/SUSE-SU-2026:1008-1.json"}},{"package":{"name":"golang-github-prometheus-node_exporter","ecosystem":"SUSE:Linux Enterprise Server 15 SP4-LTSS","purl":"pkg:rpm/suse/golang-github-prometheus-node_exporter&distro=SUSE%20Linux%20Enterprise%20Server%2015%20SP4-LTSS"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.9.1-150100.3.38.1"}]}],"ecosystem_specific":{"binaries":[{"golang-github-prometheus-node_exporter":"1.9.1-150100.3.38.1"}]},"database_specific":{"source":"https://ftp.suse.com/pub/projects/security/osv/SUSE-SU-2026:1008-1.json"}},{"package":{"name":"golang-github-prometheus-node_exporter","ecosystem":"SUSE:Linux Enterprise Server 15 SP5-LTSS","purl":"pkg:rpm/suse/golang-github-prometheus-node_exporter&distro=SUSE%20Linux%20Enterprise%20Server%2015%20SP5-LTSS"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.9.1-150100.3.38.1"}]}],"ecosystem_specific":{"binaries":[{"golang-github-prometheus-node_exporter":"1.9.1-150100.3.38.1"}]},"database_specific":{"source":"https://ftp.suse.com/pub/projects/security/osv/SUSE-SU-2026:1008-1.json"}},{"package":{"name":"golang-github-prometheus-node_exporter","ecosystem":"SUSE:Linux Enterprise Server 15 SP6-LTSS","purl":"pkg:rpm/suse/golang-github-prometheus-node_exporter&distro=SUSE%20Linux%20Enterprise%20Server%2015%20SP6-LTSS"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.9.1-150100.3.38.1"}]}],"ecosystem_specific":{"binaries":[{"golang-github-prometheus-node_exporter":"1.9.1-150100.3.38.1"}]},"database_specific":{"source":"https://ftp.suse.com/pub/projects/security/osv/SUSE-SU-2026:1008-1.json"}},{"package":{"name":"golang-github-prometheus-node_exporter","ecosystem":"SUSE:Linux Enterprise Server for SAP Applications 15 SP4","purl":"pkg:rpm/suse/golang-github-prometheus-node_exporter&distro=SUSE%20Linux%20Enterprise%20Server%20for%20SAP%20Applications%2015%20SP4"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.9.1-150100.3.38.1"}]}],"ecosystem_specific":{"binaries":[{"golang-github-prometheus-node_exporter":"1.9.1-150100.3.38.1"}]},"database_specific":{"source":"https://ftp.suse.com/pub/projects/security/osv/SUSE-SU-2026:1008-1.json"}},{"package":{"name":"golang-github-prometheus-node_exporter","ecosystem":"SUSE:Linux Enterprise Server for SAP Applications 15 SP5","purl":"pkg:rpm/suse/golang-github-prometheus-node_exporter&distro=SUSE%20Linux%20Enterprise%20Server%20for%20SAP%20Applications%2015%20SP5"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.9.1-150100.3.38.1"}]}],"ecosystem_specific":{"binaries":[{"golang-github-prometheus-node_exporter":"1.9.1-150100.3.38.1"}]},"database_specific":{"source":"https://ftp.suse.com/pub/projects/security/osv/SUSE-SU-2026:1008-1.json"}},{"package":{"name":"golang-github-prometheus-node_exporter","ecosystem":"SUSE:Linux Enterprise Server for SAP Applications 15 SP6","purl":"pkg:rpm/suse/golang-github-prometheus-node_exporter&distro=SUSE%20Linux%20Enterprise%20Server%20for%20SAP%20Applications%2015%20SP6"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.9.1-150100.3.38.1"}]}],"ecosystem_specific":{"binaries":[{"golang-github-prometheus-node_exporter":"1.9.1-150100.3.38.1"}]},"database_specific":{"source":"https://ftp.suse.com/pub/projects/security/osv/SUSE-SU-2026:1008-1.json"}},{"package":{"name":"golang-github-prometheus-alertmanager","ecosystem":"openSUSE:Leap 15.6","purl":"pkg:rpm/opensuse/golang-github-prometheus-alertmanager&distro=openSUSE%20Leap%2015.6"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.28.1-150100.4.31.1"}]}],"ecosystem_specific":{"binaries":[{"firewalld-prometheus-config":"0.1-150100.4.29.1","golang-github-prometheus-alertmanager":"0.28.1-150100.4.31.1","golang-github-prometheus-node_exporter":"1.9.1-150100.3.38.1","golang-github-prometheus-prometheus":"3.5.0-150100.4.29.1"}]},"database_specific":{"source":"https://ftp.suse.com/pub/projects/security/osv/SUSE-SU-2026:1008-1.json"}},{"package":{"name":"golang-github-prometheus-node_exporter","ecosystem":"openSUSE:Leap 15.6","purl":"pkg:rpm/opensuse/golang-github-prometheus-node_exporter&distro=openSUSE%20Leap%2015.6"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.9.1-150100.3.38.1"}]}],"ecosystem_specific":{"binaries":[{"firewalld-prometheus-config":"0.1-150100.4.29.1","golang-github-prometheus-alertmanager":"0.28.1-150100.4.31.1","golang-github-prometheus-node_exporter":"1.9.1-150100.3.38.1","golang-github-prometheus-prometheus":"3.5.0-150100.4.29.1"}]},"database_specific":{"source":"https://ftp.suse.com/pub/projects/security/osv/SUSE-SU-2026:1008-1.json"}},{"package":{"name":"golang-github-prometheus-prometheus","ecosystem":"openSUSE:Leap 15.6","purl":"pkg:rpm/opensuse/golang-github-prometheus-prometheus&distro=openSUSE%20Leap%2015.6"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.5.0-150100.4.29.1"}]}],"ecosystem_specific":{"binaries":[{"firewalld-prometheus-config":"0.1-150100.4.29.1","golang-github-prometheus-alertmanager":"0.28.1-150100.4.31.1","golang-github-prometheus-node_exporter":"1.9.1-150100.3.38.1","golang-github-prometheus-prometheus":"3.5.0-150100.4.29.1"}]},"database_specific":{"source":"https://ftp.suse.com/pub/projects/security/osv/SUSE-SU-2026:1008-1.json"}}],"references":[{"type":"ADVISORY","url":"https://www.suse.com/support/update/announcement/2026/suse-su-20261008-1/"},{"type":"REPORT","url":"https://bugzilla.suse.com/1255588"},{"type":"REPORT","url":"https://bugzilla.suse.com/1257329"},{"type":"REPORT","url":"https://bugzilla.suse.com/1257442"},{"type":"REPORT","url":"https://bugzilla.suse.com/1257841"},{"type":"REPORT","url":"https://bugzilla.suse.com/1257897"},{"type":"WEB","url":"https://www.suse.com/security/cve/CVE-2025-12816"},{"type":"WEB","url":"https://www.suse.com/security/cve/CVE-2025-13465"},{"type":"WEB","url":"https://www.suse.com/security/cve/CVE-2025-61140"},{"type":"WEB","url":"https://www.suse.com/security/cve/CVE-2026-1615"},{"type":"WEB","url":"https://www.suse.com/security/cve/CVE-2026-25547"}]}