Package
prometheus-fips-3.5
Component
github.com/prometheus/prometheus
Latest update
Fixed version
3.5.3-r3
7.5
CVSS V3
Build, ship, and run secure software with minimal, hardened container images — rebuilt from source daily and guarded under our industry-leading remediation SLA.
Start for freeStatus
Fixed version
3.5.3-r3Impact
Backported to upstream v3.5.3 via commit a75e301 (remote: validate snappy decoded length before allocation in read endpoint). The package builds from that tag (expected-commit dcd3d551). Scanner still reports the issue because the binary's embedded Go module pseudo-version is v0.305.3+dirty (< 0.311.3 in the GHSA) — Go's module tagging doesn't reflect LTS-branch backports.
Status