CVE-2026-2303

The mongo-go-driver repository contains CGo bindings for GSSAPI (Kerberos) authentication on Linux and macOS. The C wrapper implementation contains a heap out-of-bounds read vulnerability due to incorrect assumptions about string termination in the GSSAPI standard. Since GSSAPI buffers are not guaranteed to be null-terminated or have extra padding, this results in reading one byte past the allocated heap buffer.

The mongo-go-driver repository contains CGo bindings for GSSAPI (Kerberos) authentication on Linux and macOS. The C wrapper implementation contains a heap out-of-bounds read vulnerability due to incorrect assumptions about string termination in the GSSAPI standard. Since GSSAPI buffers are not guaranteed to be null-terminated or have extra padding, this results in reading one byte past the allocated heap buffer.

Mongo-go-driver: Heap Out-of-Bounds Read in GSSAPI Error Handling in go.mongodb.org/mongo-driver

These are all security issues fixed in the apptainer-1.5.1-3.1 package on the GA media of openSUSE Tumbleweed.

These are all security issues fixed in the grafana-12.4.10-1.1 package on the GA media of openSUSE Tumbleweed.

These are all security issues fixed in the alloy-1.19.2-1.1 package on the GA media of openSUSE Tumbleweed.

These are all security issues fixed in the golang-github-prometheus-alertmanager-0.34.1-2.1 package on the GA media of openSUSE Tumbleweed.

This update for apptainer fixes the following issues:

Changes in apptainer:

• Enable building of SUID starter for SLES 15 (jsc#PED-16347).
  • Security fix for CVE-2026-2303 (bsc#1270529): Heap Out-of-Bounds Read in GSSAPI Error Handling in go.mongodb.org/mongo-driver. The dependency on mongo-driver has been removed with this version of apptainer.

This update for govulncheck-vulndb fixes the following issues:

• Update to version 0.0.20260727T201416 2026-07-27T20:14:16Z (jsc#PED-11136):

Go CVE Numbering Authority IDs added or updated with aliases:

• GO-2026-5046 CVE-2026-46385 GHSA-w8j3-pq8g-8m7w
• GO-2026-5047 CVE-2026-46384 GHSA-mc57-h6j3-3hmv
• GO-2026-5048 GHSA-mx64-mj3q-7prj
• GO-2026-5051
• GO-2026-5069 CVE-2026-30246 GHSA-35hp-hqmv-8qg8
• GO-2026-5074 CVE-2026-45022 GHSA-389r-gv7p-r3rp
• GO-2026-5105 CVE-2026-41506 GHSA-3xc5-wrhm-f963
• GO-2026-5116 CVE-2026-44517 GHSA-49p4-px3h-rq49
• GO-2026-5158 CVE-2026-41178 GHSA-5wrp-cwcj-q835
• GO-2026-5198 CVE-2026-41642 GHSA-7235-89m6-f4px
• GO-2026-5208 CVE-2026-40890 GHSA-77fj-vx54-gvh7
• GO-2026-5266 CVE-2026-41643 GHSA-8rxh-r2p6-7f2q
• GO-2026-5309 GHSA-c3wq-j5vh-68rc
• GO-2026-5327 CVE-2026-2303 GHSA-cp6g-7hqx-qxhp
• GO-2026-5336 CVE-2026-45571 GHSA-crhj-59gh-8x96
• GO-2026-5346 CVE-2026-52845 GHSA-f59h-q822-g45g
• GO-2026-5408 GHSA-gx7w-56w6-g48x
• GO-2026-5426 CVE-2026-39883 GHSA-hfvc-g4fc-pqhx
• GO-2026-5435 CVE-2026-35206 GHSA-hr2v-4r36-88hr
• GO-2026-5452 CVE-2026-34783 GHSA-j6v5-g24h-vg4j
• GO-2026-5463 CVE-2026-8276 GHSA-jcqv-2g3v-gm88
• GO-2026-5471 CVE-2026-6993 GHSA-jj45-xvq5-rhh9
• GO-2026-5490 CVE-2026-44740 GHSA-m3xc-h892-ggx6
• GO-2026-5492 CVE-2026-45135 GHSA-m675-2p33-xv9g
• GO-2026-5506 CVE-2026-29181 GHSA-mh2q-q3fh-2475
• GO-2026-5525 CVE-2026-42285 GHSA-p3w2-64xm-833j
• GO-2026-5543 CVE-2026-32952 GHSA-pjcq-xvwq-hhpj
• GO-2026-5548 CVE-2026-44166 GHSA-pq7p-mc74-g65w
• GO-2026-5566 CVE-2026-35205 GHSA-q5jf-9vfq-h4h7
• GO-2026-5569 GHSA-q76j-gcg9-vxc6
• GO-2026-5585 CVE-2026-42554 GHSA-qjv7-627w-8qjv
• GO-2026-5593 CVE-2026-40611 GHSA-qqx8-2xmm-jrv8
• GO-2026-5595 CVE-2026-52844 GHSA-qrp7-cvwr-j2c6
• GO-2026-5597 CVE-2026-44973 GHSA-qw64-3x98-g7q2
• GO-2026-5606 GHSA-r46f-3rpw-hxrv
• GO-2026-5617 CVE-2026-42306 GHSA-rg2x-37c3-w2rh
• GO-2026-5660 CVE-2026-52846 GHSA-vcc4-2c75-vc9v
• GO-2026-5666 CVE-2026-35204 GHSA-vmx8-mqv2-9gmg
• GO-2026-5684 CVE-2026-42328 GHSA-w239-58x2-q8p5
• GO-2026-5693 GHSA-w5pp-99ch-qj29
• GO-2026-5730 GHSA-wwhq-w58m-w29c
• GO-2026-5736 CVE-2026-44283 GHSA-x35m-3gp4-4fh5
• GO-2026-5740 CVE-2026-44301 GHSA-x597-9fr4-5857
• GO-2026-5748 CVE-2026-7482 GHSA-x8qc-fggm-mpqg
• GO-2026-5750 CVE-2026-7020 GHSA-x99g-8v8j-25j2
• GO-2026-5774 GHSA-3fxj-6jh8-hvhx
• GO-2026-5775 GHSA-9g5q-2w5x-hmxf
• GO-2026-5777 GHSA-rjr7-jggh-pgcp
• GO-2026-5781
• GO-2026-5841 GHSA-259r-337f-4rfw
• GO-2026-5879 CVE-2026-50162 GHSA-8xwf-rjm4-xvhv
• GO-2026-5880 CVE-2026-50163 GHSA-fxhp-mv3v-67qp
• GO-2026-5882 CVE-2026-50151 GHSA-jxpm-75mh-9fp7
• GO-2026-5884 GHSA-vh4v-2xq2-g5cg
• GO-2026-5885 CVE-2026-48978 GHSA-xf85-363p-868w
• GO-2026-5886 CVE-2026-44332 GHSA-g5vh-55hw-rxm8
• GO-2026-5887 CVE-2026-45045 GHSA-gcfq-8gqf-4876
• GO-2026-5912 CVE-2026-53624 GHSA-gv83-gqw6-9j2c
• GO-2026-5954 CVE-2026-49838 GHSA-frrj-87jh-2772
• GO-2026-5955 CVE-2026-49837 GHSA-gjrg-jjr3-56cm
• GO-2026-5960 CVE-2026-54063 GHSA-h69g-9hx6-f3v4
• GO-2026-5971 CVE-2026-37462 GHSA-pw7p-7fqv-hpj8
• GO-2026-5983 CVE-2026-54448 GHSA-q3fv-x8vg-qqm4
• GO-2026-6000 CVE-2026-50274 GHSA-74j5-xf3v-crq8
• GO-2026-6058 CVE-2026-58442 GHSA-h2x6-g7q6-344v
• GO-2026-6059 CVE-2026-58431 GHSA-h56g-4qw7-2mxg
• GO-2026-6060 CVE-2026-58426 GHSA-hg5r-vq93-9fv6
• GO-2026-6061 GHSA-hrxh-6v49-42gf
• GO-2026-6062 CVE-2026-58434 GHSA-j2w3-9c3r-g83q
• GO-2026-6063 CVE-2026-58417 GHSA-jr5x-6h83-wrxf
• GO-2026-6064 CVE-2026-55984 GHSA-m932-crvm-gcp5
• GO-2026-6065 CVE-2026-55982 GHSA-mg4f-x9v4-6h2p
• GO-2026-6066 CVE-2026-58507 GHSA-p4mj-98mv-xq26
• GO-2026-6067 CVE-2026-58445 GHSA-pgqf-926r-548m
• GO-2026-6068 CVE-2026-58427 GHSA-prr9-9mp4-5gp2
• GO-2026-6069 CVE-2026-58510 GHSA-q423-49rw-g9mh
• GO-2026-6070 CVE-2026-58432 GHSA-q9pg-jj6x-j9p6
• GO-2026-6071 CVE-2026-59766 GHSA-qf2f-qh6p-7v89
• GO-2026-6072 CVE-2026-56750 GHSA-rgv6-xp99-6mgj
• GO-2026-6073 CVE-2026-58435…

This update for golang-github-prometheus-alertmanager fixes the following issues:

Changes in golang-github-prometheus-alertmanager:

• CVE-2026-39821: Fix validation bypass and privilege escalation by updating golang.org/x/net to version 0.57.0 (bsc#1266615)

• Update to version 0.33.1 (jsc#PED-16708):

  • [BUGFIX] silences: fix silences snapshot missing legacy matchers field. This caused a bug that prevented older alertmanager versions from reading newer snapshots unnecessarily.
  • [BUGFIX] silence with no matchers should populate an empty array in API response

• Update to version 0.33.0:

  • The '--enable-feature=auto-gomaxprocs' option has been removed.
  • Add a new Microsoft Teams integration that supports adaptive cards.
  • Add support for AWS Signature V4 to call AWS services that require authentication.
  • Add support for Google Chat as a notification channel.
  • Add support for custom payloads in webhooks.

• Update to version 0.32.2:

  • [BUGFIX] Fix dispatcher goroutine leaks on destroyed alertgroup swap.

• Update to version 0.32.1:

  • [BUGFIX] dispatcher: Fix issue with dispatching to a contended route.

• Update to version 0.32.0:

  • Reduce memory allocations through pre-sizing collections and batch allocation.
  • CVE-2026-2303: Removed indirect dep on vulnerable mongodb driver (bsc#1269834)

• Update to version 0.31.1:

  • No user-visible changes

• Update to version 0.31.0:

  • Add full payload templating support for webhook notifier.
  • Add support for UTF-8 label names in UI matchers.
  • Fix escaping for matcher values with quotes in the UI.

• Update to version 0.30.1:

  • [BUGFIX] Fix memory leak in tracing client.

• Update to version 0.30.0:

  • Add Mattermost integration.
  • Add support for Slack apps.
  • Add distributed tracing support.
  • Add names to inhibition rules.
  • Add templating functions for working with URLs and JSON.
  • Allow persistent peer names in a cluster.

• Update to version 0.29.0:

  • Add incident.io notifier.
  • Add monospace message formatting.
  • Update Jira notifier to support both Jira cloud API v3 and Jira datacenter API v2.

This update for alloy fixes the following issues:

• CVE-2026-2303: go.mongodb.org/mongo-driver: mongo-go-driver has Heap Out-of-Bounds Read in GSSAPI Error Handling (bsc#1269861).
• CVE-2026-37236: github.com/grpc-ecosystem/grpc-gateway/v2/runtime: client can override the HTTP method of a POST request through the X-HTTP-Method-Override header and bypass established access control (bsc#1277996).
• CVE-2026-41178: go.opentelemetry.io/otel/baggage: no rejection of raw-length headers in baggage parsing allows for DoS via oversized inputs (bsc#1276742).
• CVE-2026-45679: go.opentelemetry.io/obi: Redis error text is exported in span status messages and can lead to exfiltration of sensitive data (bsc#1267482).
• CVE-2026-45680: go.opentelemetry.io/obi: unbounded BPF internal metrics replay can exhaust CPU and cause a DoS (bsc#1267483).
• CVE-2026-45681: go.opentelemetry.io/obi: CPU-mismatch fallback uses 256-byte buffer with 8KB size and can cause OBI out-of-bounds reads to leak memory into telemetry (bsc#1267484).
• CVE-2026-45683: go.opentelemetry.io/obi: Java TLS ioctl kprobe allows a user to point OBI at kernel memory and cause that memory to be copied into telemetry (bsc#1267486).
• CVE-2026-45684: go.opentelemetry.io/obi: log enricher mishandled writev buffers and allows multi-segment calls to read and overwrite memory beyond the first segment (bsc#1267487).
• CVE-2026-46600: golang.org/x/net/dns/dnsmessage: Parsing an invalid SVCB or HTTPS RR can panic when the size of a parameter value overflows the message buffer (bsc#1272418).
• CVE-2026-48496: opentelemetry-ebpf-profiler: Unprivileged process can trigger a denial of service on the ebpf-profiler agent (bsc#1268982).
• CVE-2026-56852: golang.org/x/text/unicode/norm: infinite loop on truncated/invalid UTF-8 input (bsc#1272028).
• CVE-2026-56854,CVE-2026-56855,CVE-2026-78662: golang.org/x/crypto/ssh: authentication bypass and deadlocks in the crypto/ssh library (bsc#1278671).
• CVE-2026-71556: github.com/go-git/go-git/v5: Arbitrary file read/write via symbolic link resolution (bsc#1276982).
• CVE-2026-71557: github.com/go-git/go-git/v5: Malicious reference names may modify files outside the reference storage (bsc#1276992).
• CVE-2026-75889: arbitrary file reads due to the prometheus.operator.servicemonitors component allowing users who can modify ServiceMonitor resources in a watched namespace to specify an arbitrary local file through bearerTokenFile (bsc#1277429).
• CVE-2026-81521: go.mongodb.org/mongo-driver: MongoDB Go Driver: Write redirection via unvalidated database name in Client.BulkWrite (bsc#1278693).
• CVE-2026-89090: github.com/aws/aws-sdk-go-v2/aws/protocol/eventstream: malformed EventStream response frames containing a crafted header value type byte outside the valid range can cause the host process to terminate (bsc#1280671).

Changes for alloy:

Update to version 1.19.2:

• Remove withdrawn lib/pq CVEs from govulncheck
• Add backticks to component name in generated doc output
• BREAKING CHANGE: prometheus.operator.servicemonitors now rejects endpoints that reference local files by default. Set allow_arbitrary_file_access = true to preserve previous behavior.
• prometheus.enrich: Support multi-label matching
• prometheus.relabel: Add opt-in TTL cache mode
• telemetry: Add new metrics for graph connections and pyroscope forwarded entries
• database_observability: Exclude system schemas from MySQL health checks and redact query text in explain_plans
• Add nop receiver to OTel Engine
• Backport dependency upgrades to address GO-2026-6061

This update for grafana fixes the following issues:

Changes in grafana:

Update to version 12.4.10:

• Security:

  • CVE-2026-17183: Fix exposing data accessible through Grafana's configured datasource credentials (bsc#1275934)
  • CVE-2026-2303: Drop dependency on vulnerable go.mongodb.org/mongo-driver (bsc#1269841)
  • CVE-2026-17033: Fix stored XSS via external Alertmanager generatorURL (bsc#1276426)
  • CVE-2026-73501: Fix fail-open authentication bypass in github.com/getkin/kin-openapi (bsc#1276973)
  • CVE-2026-19475: Fix DoS in PostgreSQL Datasource (bsc#1278307)
  • CVE-2026-14199: Fix session takeover via Auth Proxy cache key collision (bsc#1278322)

• Bug fixes:

  • Dashboards: Fix adhoc and groupby variable datasource on UI import
  • Dashboards: Fix version dates and user display names in the legacy version history page

Update to version 12.4.9:

• Features and enhancements:

  • Dashboard Import: Labels in v2 schema

• Bug fixes:

  • Azure Monitor: fix migration for dimension filters

Update to version 12.4.8:

• Security:

  • CVE-2026-19197: Fix access control in dashboard snapshots (bsc#1277025)

Update to version 12.4.7:

• Security:

  • CVE-2026-56852: Fix infinite loop on truncated/invalid UTF-8 input in golang.org/x/text/unicode/norm (bsc#1272008)

• Features and enhancements:

  • Dashboards: Get annotations and dashboard endpoint performance improvements

• Bug fixes:

  • DashboardDS: Fix Mixed panels with a time override stuck in permanent loading

Update to version 12.4.6:

• Security:

  • CVE-2026-41178: Fix opentelemetry-go's baggage parsing (bsc#1276658)

• Features and enhancements:

  • Alerting: Add protected fields authorization check to provisioning API
  • Alerting: Return 403 instead of 500 on contact point provenance mismatch

• Bug fixes:

  • Jaeger: Handle gzip, deflate, and brotli compressed API responses
  • Alerting: fix ORM table mapping bug causing SELECT alert_rule columns FROM user on PostgreSQL

• CVE-2026-39882: Prevent memory exhaustion DoS in OpenTelemetry OTLP HTTP exporters by updating to v1.43.0. (bsc#1274217)

• CVE-2026-42127: Fix DoS through memory exhaustion in grafana'a public dashboard query endpoint (bsc#1268868)

• CVE-2026-9029: Fix arbitrary code execution and information disclosure via XSS in geomap panel (bsc#1272328)

• CVE-2026-33814: Fix infinite loop in HTTP/2 transport by updating golang.org/x/net (bsc#1265763)

• CVE-2026-8609: Fix pre-authentication DoS in the OAuth login route (bsc#1271330)

• CVE-2026-1229: Update github.com/cloudflare/circl to fix producing incorect output for specific inputs (bsc#1265525) (bsc#1262187)

• CVE-2026-21723: Fix DoS vulnerability in Templates Test endpoint (bsc#1272427)

• CVE-2026-41606: Fix potential DoS in Apache Thrift (bsc#1263330)

Root has patched CVE-2026-2303 in the rootio-go.mongodb.org/mongo-driver package for Root:Go. Multiple fixed versions available.

This update for apptainer contains the following fixes:

Security fixes included on this update:

• CVE-2026-2303: go.mongodb.org/mongo-driver: Heap Out-of-Bounds Read in GSSAPI Error Handling (bsc#1270529).

Other fixes:

• Enable building of SUID starter for SLES 15 (jsc#PED-16347).

This update for govulncheck-vulndb fixes the following issues:

• Update to version 0.0.20260727T201416 2026-07-27T20:14:16Z (jsc#PED-11136):

Go CVE Numbering Authority IDs added or updated with aliases:

• GO-2026-5046 CVE-2026-46385 GHSA-w8j3-pq8g-8m7w
• GO-2026-5047 CVE-2026-46384 GHSA-mc57-h6j3-3hmv
• GO-2026-5048 GHSA-mx64-mj3q-7prj
• GO-2026-5051
• GO-2026-5069 CVE-2026-30246 GHSA-35hp-hqmv-8qg8
• GO-2026-5074 CVE-2026-45022 GHSA-389r-gv7p-r3rp
• GO-2026-5105 CVE-2026-41506 GHSA-3xc5-wrhm-f963
• GO-2026-5116 CVE-2026-44517 GHSA-49p4-px3h-rq49
• GO-2026-5158 CVE-2026-41178 GHSA-5wrp-cwcj-q835
• GO-2026-5198 CVE-2026-41642 GHSA-7235-89m6-f4px
• GO-2026-5208 CVE-2026-40890 GHSA-77fj-vx54-gvh7
• GO-2026-5266 CVE-2026-41643 GHSA-8rxh-r2p6-7f2q
• GO-2026-5309 GHSA-c3wq-j5vh-68rc
• GO-2026-5327 CVE-2026-2303 GHSA-cp6g-7hqx-qxhp
• GO-2026-5336 CVE-2026-45571 GHSA-crhj-59gh-8x96
• GO-2026-5346 CVE-2026-52845 GHSA-f59h-q822-g45g
• GO-2026-5408 GHSA-gx7w-56w6-g48x
• GO-2026-5426 CVE-2026-39883 GHSA-hfvc-g4fc-pqhx
• GO-2026-5435 CVE-2026-35206 GHSA-hr2v-4r36-88hr
• GO-2026-5452 CVE-2026-34783 GHSA-j6v5-g24h-vg4j
• GO-2026-5463 CVE-2026-8276 GHSA-jcqv-2g3v-gm88
• GO-2026-5471 CVE-2026-6993 GHSA-jj45-xvq5-rhh9
• GO-2026-5490 CVE-2026-44740 GHSA-m3xc-h892-ggx6
• GO-2026-5492 CVE-2026-45135 GHSA-m675-2p33-xv9g
• GO-2026-5506 CVE-2026-29181 GHSA-mh2q-q3fh-2475
• GO-2026-5525 CVE-2026-42285 GHSA-p3w2-64xm-833j
• GO-2026-5543 CVE-2026-32952 GHSA-pjcq-xvwq-hhpj
• GO-2026-5548 CVE-2026-44166 GHSA-pq7p-mc74-g65w
• GO-2026-5566 CVE-2026-35205 GHSA-q5jf-9vfq-h4h7
• GO-2026-5569 GHSA-q76j-gcg9-vxc6
• GO-2026-5585 CVE-2026-42554 GHSA-qjv7-627w-8qjv
• GO-2026-5593 CVE-2026-40611 GHSA-qqx8-2xmm-jrv8
• GO-2026-5595 CVE-2026-52844 GHSA-qrp7-cvwr-j2c6
• GO-2026-5597 CVE-2026-44973 GHSA-qw64-3x98-g7q2
• GO-2026-5606 GHSA-r46f-3rpw-hxrv
• GO-2026-5617 CVE-2026-42306 GHSA-rg2x-37c3-w2rh
• GO-2026-5660 CVE-2026-52846 GHSA-vcc4-2c75-vc9v
• GO-2026-5666 CVE-2026-35204 GHSA-vmx8-mqv2-9gmg
• GO-2026-5684 CVE-2026-42328 GHSA-w239-58x2-q8p5
• GO-2026-5693 GHSA-w5pp-99ch-qj29
• GO-2026-5730 GHSA-wwhq-w58m-w29c
• GO-2026-5736 CVE-2026-44283 GHSA-x35m-3gp4-4fh5
• GO-2026-5740 CVE-2026-44301 GHSA-x597-9fr4-5857
• GO-2026-5748 CVE-2026-7482 GHSA-x8qc-fggm-mpqg
• GO-2026-5750 CVE-2026-7020 GHSA-x99g-8v8j-25j2
• GO-2026-5774 GHSA-3fxj-6jh8-hvhx
• GO-2026-5775 GHSA-9g5q-2w5x-hmxf
• GO-2026-5777 GHSA-rjr7-jggh-pgcp
• GO-2026-5781
• GO-2026-5841 GHSA-259r-337f-4rfw
• GO-2026-5879 CVE-2026-50162 GHSA-8xwf-rjm4-xvhv
• GO-2026-5880 CVE-2026-50163 GHSA-fxhp-mv3v-67qp
• GO-2026-5882 CVE-2026-50151 GHSA-jxpm-75mh-9fp7
• GO-2026-5884 GHSA-vh4v-2xq2-g5cg
• GO-2026-5885 CVE-2026-48978 GHSA-xf85-363p-868w
• GO-2026-5886 CVE-2026-44332 GHSA-g5vh-55hw-rxm8
• GO-2026-5887 CVE-2026-45045 GHSA-gcfq-8gqf-4876
• GO-2026-5912 CVE-2026-53624 GHSA-gv83-gqw6-9j2c
• GO-2026-5954 CVE-2026-49838 GHSA-frrj-87jh-2772
• GO-2026-5955 CVE-2026-49837 GHSA-gjrg-jjr3-56cm
• GO-2026-5960 CVE-2026-54063 GHSA-h69g-9hx6-f3v4
• GO-2026-5971 CVE-2026-37462 GHSA-pw7p-7fqv-hpj8
• GO-2026-5983 CVE-2026-54448 GHSA-q3fv-x8vg-qqm4
• GO-2026-6000 CVE-2026-50274 GHSA-74j5-xf3v-crq8
• GO-2026-6058 CVE-2026-58442 GHSA-h2x6-g7q6-344v
• GO-2026-6059 CVE-2026-58431 GHSA-h56g-4qw7-2mxg
• GO-2026-6060 CVE-2026-58426 GHSA-hg5r-vq93-9fv6
• GO-2026-6061 GHSA-hrxh-6v49-42gf
• GO-2026-6062 CVE-2026-58434 GHSA-j2w3-9c3r-g83q
• GO-2026-6063 CVE-2026-58417 GHSA-jr5x-6h83-wrxf
• GO-2026-6064 CVE-2026-55984 GHSA-m932-crvm-gcp5
• GO-2026-6065 CVE-2026-55982 GHSA-mg4f-x9v4-6h2p
• GO-2026-6066 CVE-2026-58507 GHSA-p4mj-98mv-xq26
• GO-2026-6067 CVE-2026-58445 GHSA-pgqf-926r-548m
• GO-2026-6068 CVE-2026-58427 GHSA-prr9-9mp4-5gp2
• GO-2026-6069 CVE-2026-58510 GHSA-q423-49rw-g9mh
• GO-2026-6070 CVE-2026-58432 GHSA-q9pg-jj6x-j9p6
• GO-2026-6071 CVE-2026-59766 GHSA-qf2f-qh6p-7v89
• GO-2026-6072 CVE-2026-56750 GHSA-rgv6-xp99-6mgj
• GO-2026-6073 CVE-2026-58435…

This update for govulncheck-vulndb fixes the following issues:

• Update to version 0.0.20260727T201416 2026-07-27T20:14:16Z (jsc#PED-11136):

Go CVE Numbering Authority IDs added or updated with aliases:

• GO-2026-5046 CVE-2026-46385 GHSA-w8j3-pq8g-8m7w
• GO-2026-5047 CVE-2026-46384 GHSA-mc57-h6j3-3hmv
• GO-2026-5048 GHSA-mx64-mj3q-7prj
• GO-2026-5051
• GO-2026-5069 CVE-2026-30246 GHSA-35hp-hqmv-8qg8
• GO-2026-5074 CVE-2026-45022 GHSA-389r-gv7p-r3rp
• GO-2026-5105 CVE-2026-41506 GHSA-3xc5-wrhm-f963
• GO-2026-5116 CVE-2026-44517 GHSA-49p4-px3h-rq49
• GO-2026-5158 CVE-2026-41178 GHSA-5wrp-cwcj-q835
• GO-2026-5198 CVE-2026-41642 GHSA-7235-89m6-f4px
• GO-2026-5208 CVE-2026-40890 GHSA-77fj-vx54-gvh7
• GO-2026-5266 CVE-2026-41643 GHSA-8rxh-r2p6-7f2q
• GO-2026-5309 GHSA-c3wq-j5vh-68rc
• GO-2026-5327 CVE-2026-2303 GHSA-cp6g-7hqx-qxhp
• GO-2026-5336 CVE-2026-45571 GHSA-crhj-59gh-8x96
• GO-2026-5346 CVE-2026-52845 GHSA-f59h-q822-g45g
• GO-2026-5408 GHSA-gx7w-56w6-g48x
• GO-2026-5426 CVE-2026-39883 GHSA-hfvc-g4fc-pqhx
• GO-2026-5435 CVE-2026-35206 GHSA-hr2v-4r36-88hr
• GO-2026-5452 CVE-2026-34783 GHSA-j6v5-g24h-vg4j
• GO-2026-5463 CVE-2026-8276 GHSA-jcqv-2g3v-gm88
• GO-2026-5471 CVE-2026-6993 GHSA-jj45-xvq5-rhh9
• GO-2026-5490 CVE-2026-44740 GHSA-m3xc-h892-ggx6
• GO-2026-5492 CVE-2026-45135 GHSA-m675-2p33-xv9g
• GO-2026-5506 CVE-2026-29181 GHSA-mh2q-q3fh-2475
• GO-2026-5525 CVE-2026-42285 GHSA-p3w2-64xm-833j
• GO-2026-5543 CVE-2026-32952 GHSA-pjcq-xvwq-hhpj
• GO-2026-5548 CVE-2026-44166 GHSA-pq7p-mc74-g65w
• GO-2026-5566 CVE-2026-35205 GHSA-q5jf-9vfq-h4h7
• GO-2026-5569 GHSA-q76j-gcg9-vxc6
• GO-2026-5585 CVE-2026-42554 GHSA-qjv7-627w-8qjv
• GO-2026-5593 CVE-2026-40611 GHSA-qqx8-2xmm-jrv8
• GO-2026-5595 CVE-2026-52844 GHSA-qrp7-cvwr-j2c6
• GO-2026-5597 CVE-2026-44973 GHSA-qw64-3x98-g7q2
• GO-2026-5606 GHSA-r46f-3rpw-hxrv
• GO-2026-5617 CVE-2026-42306 GHSA-rg2x-37c3-w2rh
• GO-2026-5660 CVE-2026-52846 GHSA-vcc4-2c75-vc9v
• GO-2026-5666 CVE-2026-35204 GHSA-vmx8-mqv2-9gmg
• GO-2026-5684 CVE-2026-42328 GHSA-w239-58x2-q8p5
• GO-2026-5693 GHSA-w5pp-99ch-qj29
• GO-2026-5730 GHSA-wwhq-w58m-w29c
• GO-2026-5736 CVE-2026-44283 GHSA-x35m-3gp4-4fh5
• GO-2026-5740 CVE-2026-44301 GHSA-x597-9fr4-5857
• GO-2026-5748 CVE-2026-7482 GHSA-x8qc-fggm-mpqg
• GO-2026-5750 CVE-2026-7020 GHSA-x99g-8v8j-25j2
• GO-2026-5774 GHSA-3fxj-6jh8-hvhx
• GO-2026-5775 GHSA-9g5q-2w5x-hmxf
• GO-2026-5777 GHSA-rjr7-jggh-pgcp
• GO-2026-5781
• GO-2026-5841 GHSA-259r-337f-4rfw
• GO-2026-5879 CVE-2026-50162 GHSA-8xwf-rjm4-xvhv
• GO-2026-5880 CVE-2026-50163 GHSA-fxhp-mv3v-67qp
• GO-2026-5882 CVE-2026-50151 GHSA-jxpm-75mh-9fp7
• GO-2026-5884 GHSA-vh4v-2xq2-g5cg
• GO-2026-5885 CVE-2026-48978 GHSA-xf85-363p-868w
• GO-2026-5886 CVE-2026-44332 GHSA-g5vh-55hw-rxm8
• GO-2026-5887 CVE-2026-45045 GHSA-gcfq-8gqf-4876
• GO-2026-5912 CVE-2026-53624 GHSA-gv83-gqw6-9j2c
• GO-2026-5954 CVE-2026-49838 GHSA-frrj-87jh-2772
• GO-2026-5955 CVE-2026-49837 GHSA-gjrg-jjr3-56cm
• GO-2026-5960 CVE-2026-54063 GHSA-h69g-9hx6-f3v4
• GO-2026-5971 CVE-2026-37462 GHSA-pw7p-7fqv-hpj8
• GO-2026-5983 CVE-2026-54448 GHSA-q3fv-x8vg-qqm4
• GO-2026-6000 CVE-2026-50274 GHSA-74j5-xf3v-crq8
• GO-2026-6058 CVE-2026-58442 GHSA-h2x6-g7q6-344v
• GO-2026-6059 CVE-2026-58431 GHSA-h56g-4qw7-2mxg
• GO-2026-6060 CVE-2026-58426 GHSA-hg5r-vq93-9fv6
• GO-2026-6061 GHSA-hrxh-6v49-42gf
• GO-2026-6062 CVE-2026-58434 GHSA-j2w3-9c3r-g83q
• GO-2026-6063 CVE-2026-58417 GHSA-jr5x-6h83-wrxf
• GO-2026-6064 CVE-2026-55984 GHSA-m932-crvm-gcp5
• GO-2026-6065 CVE-2026-55982 GHSA-mg4f-x9v4-6h2p
• GO-2026-6066 CVE-2026-58507 GHSA-p4mj-98mv-xq26
• GO-2026-6067 CVE-2026-58445 GHSA-pgqf-926r-548m
• GO-2026-6068 CVE-2026-58427 GHSA-prr9-9mp4-5gp2
• GO-2026-6069 CVE-2026-58510 GHSA-q423-49rw-g9mh
• GO-2026-6070 CVE-2026-58432 GHSA-q9pg-jj6x-j9p6
• GO-2026-6071 CVE-2026-59766 GHSA-qf2f-qh6p-7v89
• GO-2026-6072 CVE-2026-56750 GHSA-rgv6-xp99-6mgj
• GO-2026-6073 CVE-2026-58435…

This update for alloy fixes the following issues:

• CVE-2026-2303: go.mongodb.org/mongo-driver: mongo-go-driver has Heap Out-of-Bounds Read in GSSAPI Error Handling (bsc#1269861).
• CVE-2026-37236: github.com/grpc-ecosystem/grpc-gateway/v2/runtime: client can override the HTTP method of a POST request through the X-HTTP-Method-Override header and bypass established access control (bsc#1277996).
• CVE-2026-41178: go.opentelemetry.io/otel/baggage: no rejection of raw-length headers in baggage parsing allows for DoS via oversized inputs (bsc#1276742).
• CVE-2026-45679: go.opentelemetry.io/obi: Redis error text is exported in span status messages and can lead to exfiltration of sensitive data (bsc#1267482).
• CVE-2026-45680: go.opentelemetry.io/obi: unbounded BPF internal metrics replay can exhaust CPU and cause a DoS (bsc#1267483).
• CVE-2026-45681: go.opentelemetry.io/obi: CPU-mismatch fallback uses 256-byte buffer with 8KB size and can cause OBI out-of-bounds reads to leak memory into telemetry (bsc#1267484).
• CVE-2026-45683: go.opentelemetry.io/obi: Java TLS ioctl kprobe allows a user to point OBI at kernel memory and cause that memory to be copied into telemetry (bsc#1267486).
• CVE-2026-45684: go.opentelemetry.io/obi: log enricher mishandled writev buffers and allows multi-segment calls to read and overwrite memory beyond the first segment (bsc#1267487).
• CVE-2026-46600: golang.org/x/net/dns/dnsmessage: Parsing an invalid SVCB or HTTPS RR can panic when the size of a parameter value overflows the message buffer (bsc#1272418).
• CVE-2026-48496: opentelemetry-ebpf-profiler: Unprivileged process can trigger a denial of service on the ebpf-profiler agent (bsc#1268982).
• CVE-2026-56852: golang.org/x/text/unicode/norm: infinite loop on truncated/invalid UTF-8 input (bsc#1272028).
• CVE-2026-56854,CVE-2026-56855,CVE-2026-78662: golang.org/x/crypto/ssh: authentication bypass and deadlocks in the crypto/ssh library (bsc#1278671).
• CVE-2026-71556: github.com/go-git/go-git/v5: Arbitrary file read/write via symbolic link resolution (bsc#1276982).
• CVE-2026-71557: github.com/go-git/go-git/v5: Malicious reference names may modify files outside the reference storage (bsc#1276992).
• CVE-2026-75889: arbitrary file reads due to the prometheus.operator.servicemonitors component allowing users who can modify ServiceMonitor resources in a watched namespace to specify an arbitrary local file through bearerTokenFile (bsc#1277429).
• CVE-2026-81521: go.mongodb.org/mongo-driver: MongoDB Go Driver: Write redirection via unvalidated database name in Client.BulkWrite (bsc#1278693).
• CVE-2026-89090: github.com/aws/aws-sdk-go-v2/aws/protocol/eventstream: malformed EventStream response frames containing a crafted header value type byte outside the valid range can cause the host process to terminate (bsc#1280671).

Changes for alloy:

Update to version 1.19.2:

• Remove withdrawn lib/pq CVEs from govulncheck
• Add backticks to component name in generated doc output
• BREAKING CHANGE: prometheus.operator.servicemonitors now rejects endpoints that reference local files by default. Set allow_arbitrary_file_access = true to preserve previous behavior.
• prometheus.enrich: Support multi-label matching
• prometheus.relabel: Add opt-in TTL cache mode
• telemetry: Add new metrics for graph connections and pyroscope forwarded entries
• database_observability: Exclude system schemas from MySQL health checks and redact query text in explain_plans
• Add nop receiver to OTel Engine
• Backport dependency upgrades to address GO-2026-6061

This update for alloy fixes the following issues:

• CVE-2026-2303: go.mongodb.org/mongo-driver: mongo-go-driver has Heap Out-of-Bounds Read in GSSAPI Error Handling (bsc#1269861).
• CVE-2026-37236: github.com/grpc-ecosystem/grpc-gateway/v2/runtime: client can override the HTTP method of a POST request through the X-HTTP-Method-Override header and bypass established access control (bsc#1277996).
• CVE-2026-41178: go.opentelemetry.io/otel/baggage: no rejection of raw-length headers in baggage parsing allows for DoS via oversized inputs (bsc#1276742).
• CVE-2026-45679: go.opentelemetry.io/obi: Redis error text is exported in span status messages and can lead to exfiltration of sensitive data (bsc#1267482).
• CVE-2026-45680: go.opentelemetry.io/obi: unbounded BPF internal metrics replay can exhaust CPU and cause a DoS (bsc#1267483).
• CVE-2026-45681: go.opentelemetry.io/obi: CPU-mismatch fallback uses 256-byte buffer with 8KB size and can cause OBI out-of-bounds reads to leak memory into telemetry (bsc#1267484).
• CVE-2026-45683: go.opentelemetry.io/obi: Java TLS ioctl kprobe allows a user to point OBI at kernel memory and cause that memory to be copied into telemetry (bsc#1267486).
• CVE-2026-45684: go.opentelemetry.io/obi: log enricher mishandled writev buffers and allows multi-segment calls to read and overwrite memory beyond the first segment (bsc#1267487).
• CVE-2026-46600: golang.org/x/net/dns/dnsmessage: Parsing an invalid SVCB or HTTPS RR can panic when the size of a parameter value overflows the message buffer (bsc#1272418).
• CVE-2026-48496: opentelemetry-ebpf-profiler: Unprivileged process can trigger a denial of service on the ebpf-profiler agent (bsc#1268982).
• CVE-2026-56852: golang.org/x/text/unicode/norm: infinite loop on truncated/invalid UTF-8 input (bsc#1272028).
• CVE-2026-56854,CVE-2026-56855,CVE-2026-78662: golang.org/x/crypto/ssh: authentication bypass and deadlocks in the crypto/ssh library (bsc#1278671).
• CVE-2026-71556: github.com/go-git/go-git/v5: Arbitrary file read/write via symbolic link resolution (bsc#1276982).
• CVE-2026-71557: github.com/go-git/go-git/v5: Malicious reference names may modify files outside the reference storage (bsc#1276992).
• CVE-2026-75889: arbitrary file reads due to the prometheus.operator.servicemonitors component allowing users who can modify ServiceMonitor resources in a watched namespace to specify an arbitrary local file through bearerTokenFile (bsc#1277429).
• CVE-2026-81521: go.mongodb.org/mongo-driver: MongoDB Go Driver: Write redirection via unvalidated database name in Client.BulkWrite (bsc#1278693).
• CVE-2026-89090: github.com/aws/aws-sdk-go-v2/aws/protocol/eventstream: malformed EventStream response frames containing a crafted header value type byte outside the valid range can cause the host process to terminate (bsc#1280671).

Changes for alloy:

• Update to version 1.19.2.
• Update to version 1.19.1.
• Update to version 1.19.0:

• BREAKING CHANGE: prometheus.operator.servicemonitors now rejects endpoints that reference local files by default. Set allow_arbitrary_file_access = true to preserve previous behavior.
• prometheus.enrich: Support multi-label matching
• prometheus.relabel: Add opt-in TTL cache mode
• telemetry: Add new metrics for graph connections and pyroscope forwarded entries
• database_observability: Exclude system schemas from MySQL health checks and redact query text in explain_plans

• Update to version 1.18.1:

• Add nop receiver to OTel Engine

This update fixes the following issues:

golang-github-prometheus-prometheus was updated to version 3.13.2:

• Security issues:

  • CVE-2026-39821: Fixed validation bypass and privilege escalation in Punycode label handling (bsc#1266608)
  • CVE-2026-56852: Fixed infinite loop on truncated or invalid UTF-8 input in unicode/norm handling (bsc#1272102)
  • CVE-2026-44990: Fixed stored XSS in the new React UI by sanitizing disallowed xmp elements (bsc#1275205)
  • CVE-2026-53606: Fixed incomplete URI scheme validation in sanitize-html that could enable XSS (bsc#1269966)
  • CVE-2026-2303: Fixed heap out-of-bounds read in GSSAPI error handling in mongo-driver (bsc#1269856)
  • CVE-2025-4673: Fixed credential leaks by stopping HTTP client header forwarding on redirects (bsc#1275206)
  • CVE-2023-45289: Fixed credential leaks by stopping header and cookie forwarding on HTTP redirects (bsc#1275207)
  • CVE-2025-61686: Fixed unauthorized file access and path traversal in react-router storage (bsc#1270711)
  • CVE-2026-40181: Fixed open redirect risks to external domains via relative paths in react-router (bsc#1267528)
  • CVE-2026-42342: Fixed DoS risks via unbounded path expansion in the manifest endpoint (bsc#1267538)
  • CVE-2026-42211: Fixed remote code execution risks from prototype pollution in react-router (bsc#1267534)
  • CVE-2026-39882: Fixed memory exhaustion via uncapped HTTP response reading in OpenTelemetry (bsc#1274221)
  • Fixed potential denial-of-service vulnerabilities by updating the gRPC dependency
  • Fixed memory exhaustion and DoS by rejecting snappy-compressed requests exceeding 32MB limit

• Bug fixes and changes:

  • Fixed scrape manager failing to reload properly when SD configuration changes rapidly.
  • Prevent memory leak in remote-write path when the receiving endpoint is unavailable.
  • Native Histograms are no longer experimental. They are fully supported for production workloads.
  • Added support for OpenTelemetry traces within the Prometheus UI to correlate metrics and traces.
  • TSDB compaction speed optimized by improving the block merging algorithm.
  • Allow scraping of multiple targets using a single HTTP/2 connection to reduce overhead.
  • Added new metrics to monitor the health of the rule evaluation engine.
  • Incompatible: This affects scraping, remote read and write, alerting, and SD. Network paths might need adjustments to avoid redirects.
  • Incompatible: Rule group pagination tokens now use SHA-256 instead of MD5. Custom API consumers must adapt to the new longer token format.
  • Added 'group_limit' parameter to PromQL aggregations to restrict the number of results.
  • Incompatible: promtool relative paths in config files now resolve relative to the config directory itself, instead of the current working directory.
  • Support exporting TSDB blocks directly to cloud storage via the admin API.
  • Incompatible: Deprecated remote-write metrics like prometheus_remote_storage_samples_total are removed in favor of prometheus_wal_watcher_records_read_total.
  • Significant query performance boost for high-cardinality regex matchers.
  • Introduce a new UI interface for safely deleting specific time series data directly.
  • Added dynamic relabeling actions to extract substrings using regex capture groups.
  • Fixed UI displaying incorrect time ranges after a timezone change.
  • Bumped firewalld-prometheus-config to version 0.2 bumping OpenTelemetry to 1.43.0

grafana was updated to version 12.4.10:

• Security issues:

  • CVE-2026-17183: Fixed exposing data accessible through Grafana's configured datasource credentials (bsc#1275934)
  • CVE-2026-2303: Fixed heap out-of-bounds read in GSSAPI error handling in mongo-driver (bsc#1269841)
  • CVE-2026-17033: Fixed stored cross-site scripting risks via malicious Alertmanager generator URLs (bsc#1276426)
  • CVE-2026-73501: Fixed fail-open authentication bypass in kin-openapi default handlers (bsc#1276973) *…

This update for grafana, system-user-grafana fixes the following issues:

• Update to version 12.4.10:

  • Security: CVE-2026-17183: Fix exposing data accessible through Grafana's configured datasource credentials (bsc#1275934) CVE-2026-2303: Drop dependency on vulnerable go.mongodb.org/mongo-driver (bsc#1269841) CVE-2026-17033: Fix stored XSS via external Alertmanager generatorURL (bsc#1276426) CVE-2026-73501: Fix fail-open authentication bypass in github.com/getkin/kin-openapi (bsc#1276973) CVE-2026-19475: Fix DoS in PostgreSQL Datasource (bsc#1278307) CVE-2026-14199: Fix session takeover via Auth Proxy cache key collision (bsc#1278322)
  • Bug fixes: Dashboards: Fix adhoc and groupby variable datasource on UI import Dashboards: Fix version dates and user display names in the legacy version history page

• Update to version 12.4.9:

  • Features and enhancements: Dashboard Import: Labels in v2 schema
  • Bug fixes: Azure Monitor: fix migration for dimension filters

• Update to version 12.4.8:

  • Security: CVE-2026-19197: Fix access control in dashboard snapshots (bsc#1277025)

• Update to version 12.4.7:

  • Security: CVE-2026-56852: Fix infinite loop on truncated/invalid UTF-8 input in golang.org/x/text/unicode/norm (bsc#1272008)
  • Features and enhancements: Dashboards: Get annotations and dashboard endpoint performance improvements
  • Bug fixes: DashboardDS: Fix Mixed panels with a time override stuck in permanent loading

• Update to version 12.4.6:

  • Security: CVE-2026-41178: Fix opentelemetry-go's baggage parsing (bsc#1276658)
  • Features and enhancements: Alerting: Add protected fields authorization check to provisioning API Alerting: Return 403 instead of 500 on contact point provenance mismatch
  • Bug fixes: Jaeger: Handle gzip, deflate, and brotli compressed API responses Alerting: fix ORM table mapping bug causing SELECT alert_rule columns FROM user on PostgreSQL

• Drop 0005-Bump-edwards25519.patch

  CVE-2026-39882: Prevent memory exhaustion DoS in OpenTelemetry OTLP HTTP exporters by updating to v1.43.0. (bsc#1274217) CVE-2026-8595: Fix stored XSS in the table panel (bsc#1271557) CVE-2026-42127: Fix DoS through memory exhaustion in grafana'a public dashboard query endpoint (bsc#1268868) CVE-2026-9029: Fix arbitrary code execution and information disclosure via XSS in geomap panel (bsc#1272328) CVE-2026-33814: Fix infinite loop in HTTP/2 transport by updating golang.org/x/net (bsc#1265763) CVE-2026-8609: Fix pre-authentication DoS in the OAuth login route (bsc#1271330)

  • CVE-2026-1229: Update github.com/cloudflare/circl to fix producing incorect output for specific inputs (bsc#1265525) (bsc#1262187)
  • CVE-2026-21723: Fix DoS vulnerability in Templates Test endpoint (bsc#1272427)

• CVE-2026-41606: Fix potential DoS in Apache Thrift (bsc#1263330)

• Build only for SUSE distributions

This update for golang-github-prometheus-prometheus fixes the following issues:

golang-github-prometheus-prometheus was updated to version 3.13.2:

• Security issues:

  • CVE-2026-39821: Fixed validation bypass and privilege escalation in Punycode label handling (bsc#1266608)
  • CVE-2026-56852: Fixed infinite loop on truncated or invalid UTF-8 input in unicode/norm handling (bsc#1272102)
  • CVE-2026-44990: Fixed stored XSS in the new React UI by sanitizing disallowed xmp elements (bsc#1275205)
  • CVE-2026-53606: Fixed incomplete URI scheme validation in sanitize-html that could enable XSS (bsc#1269966)
  • CVE-2026-2303: Fixed heap out-of-bounds read in GSSAPI error handling in mongo-driver (bsc#1269856)
  • CVE-2025-4673: Fixed credential leaks by stopping HTTP client header forwarding on redirects (bsc#1275206)
  • CVE-2023-45289: Fixed credential leaks by stopping header and cookie forwarding on HTTP redirects (bsc#1275207)
  • CVE-2025-61686: Fixed unauthorized file access and path traversal in react-router storage (bsc#1270711)
  • CVE-2026-40181: Fixed open redirect risks to external domains via relative paths in react-router (bsc#1267528)
  • CVE-2026-42342: Fixed DoS risks via unbounded path expansion in the manifest endpoint (bsc#1267538)
  • CVE-2026-42211: Fixed remote code execution risks from prototype pollution in react-router (bsc#1267534)
  • CVE-2026-39882: Fixed memory exhaustion via uncapped HTTP response reading in OpenTelemetry (bsc#1274221)
  • Fixed potential denial-of-service vulnerabilities by updating the gRPC dependency
  • Fixed memory exhaustion and DoS by rejecting snappy-compressed requests exceeding 32MB limit

• Bug fixes and changes:

  • Fixed scrape manager failing to reload properly when SD configuration changes rapidly.
  • Prevent memory leak in remote-write path when the receiving endpoint is unavailable.
  • Native Histograms are no longer experimental. They are fully supported for production workloads.
  • Added support for OpenTelemetry traces within the Prometheus UI to correlate metrics and traces.
  • TSDB compaction speed optimized by improving the block merging algorithm.
  • Allow scraping of multiple targets using a single HTTP/2 connection to reduce overhead.
  • Added new metrics to monitor the health of the rule evaluation engine.
  • Incompatible: This affects scraping, remote read and write, alerting, and SD. Network paths might need adjustments to avoid redirects.
  • Incompatible: Rule group pagination tokens now use SHA-256 instead of MD5. Custom API consumers must adapt to the new longer token format.
  • Added 'group_limit' parameter to PromQL aggregations to restrict the number of results.
  • Incompatible: promtool relative paths in config files now resolve relative to the config directory itself, instead of the current working directory.
  • Support exporting TSDB blocks directly to cloud storage via the admin API.
  • Incompatible: Deprecated remote-write metrics like prometheus_remote_storage_samples_total are removed in favor of prometheus_wal_watcher_records_read_total.
  • Significant query performance boost for high-cardinality regex matchers.
  • Introduce a new UI interface for safely deleting specific time series data directly.
  • Added dynamic relabeling actions to extract substrings using regex capture groups.
  • Fixed UI displaying incorrect time ranges after a timezone change.
  • Bumped firewalld-prometheus-config to version 0.2 bumping OpenTelemetry to 1.43.0