This update for Prometheus fixes the following issues:
golang-github-prometheus-alertmanager, golang-github-prometheus-node_exporter:
- Internal changes to fix build issues with no impact for customers
golang-github-prometheus-prometheus:
- Security issues fixed:
* CVE-2026-27606: Fixed arbitrary file write via path traversal in rollup (bsc#1258893)
* CVE-2026-25547: Fixed unbounded brace range expansion leading to excessive CPU and memory consumption (bsc#1257841)
* CVE-2026-1615, CVE-2025-61140 The old web UI is no longer built due to security issues (bsc#1257897, bsc#1257442)
* CVE-2025-13465: Bump lodash package to versio
Security update for golang-github-prometheus-node_exporter
This update for golang-github-prometheus-node_exporter fixes the following issues:
golang-github-prometheus-node_exporter was updated to version 1.9.1:
- Security issues fixed:
* CVE-2025-22870: Bumped golang.org/x/net to version 0.37.0 (bsc#1238686)
- Other bugs fixed:
* pressure: Fixed missing IRQ on older kernels
* Fix Darwin memory leak
This update for Golang Prometheus fixes the following issues:
golang-github-prometheus-alertmanager:
- CVE-2023-29409: Restrict RSA keys in certificates to less than or equal to 8192 bits to avoid DoSing client/server
while validating signatures for extremely large RSA keys. (bsc#1213880)
There are no direct source changes. The CVE is fixed rebuilding the sources with the patched Go version.
golang-github-prometheus-node_exporter:
- CVE-2023-29409: Restrict RSA keys in certificates to less than or equal to 8192 bits to avoid DoSing client/server
while validating signatures for extremely large RSA keys. (bsc#1213880)
There are no d
This update for golang-github-prometheus-alertmanager and golang-github-prometheus-node_exporter fixes the following issues:
golang-github-prometheus-alertmanager:
- Security issues fixed:
* CVE-2022-46146: Fix authentication bypass via cache poisoning (bsc#1208051)
golang-github-prometheus-node_exporter:
- Security issues fixed in this version update to version 1.5.0 (jsc#PED-3578):
* CVE-2022-27191: Update go/x/crypto (bsc#1197284)
* CVE-2022-27664: Update go/x/net (bsc#1203185)
* CVE-2022-46146: Update exporter-toolkit (bsc#1208064)
- Other non-security bug fixes and changes in this version update to 1.5.0 (jsc#PED-3578)