VersionDrift
Product

Prometheus

Monitoring · products/prometheus.yaml · RSS

Latest 3.15.1 Oct 21, 2026

Lifecycle

BranchLatestReleasedEnd of life
3.153.15.1Sep 24, 2026Nov 6, 2026 · maintained
3.143.14.0Aug 17, 2026Sep 30, 2026 · ended
3.13 LTS3.13.5Jul 1, 2026Jul 31, 2027 · maintained
3.123.12.0May 28, 2026Jul 9, 2026 · ended
3.113.11.3Apr 2, 2026May 14, 2026 · ended
3.103.10.0Feb 25, 2026Apr 8, 2026 · ended
3.93.9.1Jan 6, 2026Feb 17, 2026 · ended
3.83.8.1Nov 28, 2025Jan 9, 2026 · ended
3.73.7.3Oct 15, 2025Nov 26, 2025 · ended
3.63.6.0Sep 17, 2025Nov 2, 2025 · ended
3.5 LTS3.5.5Jul 14, 2025Jul 31, 2026 · ended
3.43.4.2May 17, 2025Jun 28, 2025 · ended
3.33.3.1Apr 15, 2025May 27, 2025 · ended
3.23.2.1Feb 17, 2025Mar 31, 2025 · ended
3.13.1.0Jan 2, 2025Feb 13, 2025 · ended
3.03.0.1Nov 14, 2024Dec 26, 2024 · ended
2.552.55.1Oct 22, 2024Dec 3, 2024 · ended
2.542.54.1Aug 9, 2024Sep 20, 2024 · ended
2.53 LTS2.53.5Jun 16, 2024Jul 31, 2025 · ended
2.522.52.0May 8, 2024Jun 19, 2024 · ended
2.512.51.2Mar 19, 2024Apr 30, 2024 · ended
2.502.50.1Feb 22, 2024Apr 4, 2024 · ended
2.492.49.1Jan 15, 2024Feb 26, 2024 · ended
2.482.48.1Nov 15, 2023Dec 28, 2023 · ended
2.472.47.2Sep 6, 2023Oct 18, 2023 · ended
2.462.46.0Jul 25, 2023Sep 5, 2023 · ended
2.45 LTS2.45.6Jun 23, 2023Jul 31, 2024 · ended
2.442.44.0May 14, 2023Aug 6, 2023 · ended
2.432.43.1Mar 21, 2023May 2, 2023 · ended
2.422.42.0Jan 31, 2023Mar 14, 2023 · ended
2.412.41.0Dec 20, 2022Jan 31, 2023 · ended
2.402.40.7Nov 7, 2022Dec 19, 2022 · ended
2.392.39.2Oct 5, 2022Nov 16, 2022 · ended
2.382.38.0Aug 16, 2022Sep 27, 2022 · ended
2.37 LTS2.37.9Jul 14, 2022Jul 31, 2023 · ended
2.362.36.2May 30, 2022Jul 11, 2022 · ended

Recent releases

3.15.1 Oct 21, 2026 Release notes ↗ 3security
security[SECURITY] Container images: Update CA certificates to distrust "emSign ECC Root CA - G3" and "Comodo AAA Services root" following the compromise of eMudhra intermediate CA private keys.
security[SECURITY] Build with Go 1.27.3 to fix vulnerabilities in net/http, net/textproto, crypto/tls and html/template.
security[SECURITY] Bump golang.org/x/net to v0.60.0 to fix HTTP/2 vulnerabilities (GO-2026-6603, GO-2026-6610, GO-2026-6611, GO-2026-6612, GO-2026-6617).
3.15.0 Sep 25, 2026 → 3.15.1 Release notes ↗ 23fix3deprecated12feature2breaking
breaking[BUGFIX] Discovery: delete the stale prometheus_sd_last_update_timestamp_seconds series for a config that is removed on reload. #19131
breaking[BUGFIX] UI: Remove an extraneous X-axis tick mark in the native histogram chart when using the "linear" display mode. #19326
3.14.0 Aug 18, 2026 → 3.15.1 Release notes ↗ 1deprecated8feature20fix1breaking
breaking[BUGFIX] Rules: Clean up stale rule_group_last_rule_duration_sum_seconds and rule_group_last_restore_duration_seconds series when a rule group is removed or renamed on reload. Previously each reload leaked two series per dropped group, growing /metrics cardinality over time. #19107
3.13.5 Oct 21, 2026 → 3.15.1 Release notes ↗ 4security
security[SECURITY] Container images: Update CA certificates to distrust "emSign ECC Root CA - G3" and "Comodo AAA Services root" following the compromise of eMudhra intermediate CA private keys.
security[SECURITY] Build with Go 1.26.10 to fix vulnerabilities in net/http, net/textproto, crypto/tls and html/template.
security[SECURITY] Bump golang.org/x/net to v0.60.0 to fix HTTP/2 vulnerabilities (GO-2026-6603, GO-2026-6610, GO-2026-6611, GO-2026-6612, GO-2026-6617).
3.13.4 Oct 2, 2026 → 3.15.1 Release notes ↗ 2security3fix
security[SECURITY] Bump google.golang.org/grpc to v1.83.1 to fix HTTP/2 DATA frame fragmentation memory exhaustion (GO-2026-6348). #19834
security[SECURITY] UI: Update vulnerable npm dependencies. #19834
3.13.3 Sep 7, 2026 → 3.15.1 Release notes ↗ 1security7fix
security[SECURITY] Bump github.com/klauspost/compress to v1.18.7 (GO-2026-5841) and golang.org/x/crypto to v0.55.0 (GO-2026-6303).
3.13.2 Jul 30, 2026 → 3.15.1 Release notes ↗ 1security1fix
security[SECURITY] Bump golang.org/x/text to v0.39.0 (CVE-2026-56852) and google.golang.org/grpc to v1.82.1 (GHSA-hrxh-6v49-42gf). #19290 by @krajorama
3.13.1 Jul 10, 2026 → 3.15.1 Release notes ↗ 1fix
3.13.0 Jul 1, 2026 → 3.15.1 Release notes ↗ 2security10feature17fix1breaking
security[SECURITY] UI: Bump sanitize-html to fix a cross-site scripting vulnerability (CVE-2026-44990). #18697
security[CHANGE] HTTP clients: Credentials (Authorization header, basic auth, bearer token, OAuth2, configured headers) are no longer forwarded when following a redirect to a different host; affects scraping, remote read/write, alerting, and service discovery. Via prometheus/common v0.69.0 (CVE-2025-4673…
breaking[BUGFIX] TSDB: Prevent loss of samples at the chunk-range boundary when CompactSelectedSeries (and CompactStaleHead) evict the series — the per-slice compaction loop now runs one more iteration so the boundary timestamp is captured in a block before the in-memory copy is removed. #18849
3.12.0 May 28, 2026 → 3.15.1 Release notes ↗ 19feature2security18fix1breaking
security[SECURITY] Remote: Reject snappy-compressed received requests via Remote Write whose declared decoded length exceeds the 32MB. Thanks to @hibrian827 for reporting it. #18642
security[SECURITY] STACKIT SD: Fix secrets being exposed in plaintext via /-/config endpoint. Thanks to @August829 and @Phaxma for reporting. GHSA-39j6-789q-qxvh #18649
breaking[BUGFIX] prometheus_sd_refresh* and prometheus_sd_discovered_targets metrics for specific scrape jobs are deleted when the scrape job is removed. #17614
3.11.3 Apr 27, 2026 → 3.15.1 Release notes ↗ 6security
securityShadowbyte (4c1dr3aper) - Charlie Lewis for the Remote-Read snappy decode vulnerability.
securityBrett Gervasoni for the AzureAD OAuth client_secret vulnerability.
security@iiihaiii and @Ngocnn97 for the Old UI XSS vulnerability.
3.11.2 Apr 13, 2026 → 3.15.1 Release notes ↗ 1security1feature1fix
security[SECURITY] UI: Fix stored XSS via unescaped metric names and labels. CVE-2026-40179. #18506
3.11.1 Apr 7, 2026 → 3.15.1 Release notes ↗ 1fix
3.11.0 Apr 2, 2026 → 3.15.1 Release notes ↗ 3deprecated13feature2breaking1security21fix
breaking[ENHANCEMENT] TSDB: Remove old temporary checkpoints when creating a Checkpoint. #17598
security[ENHANCEMENT] Vultr SD: Upgrade govultr library from v2 to v3 for continued security patches and maintenance. #18347
breaking[BUGFIX] TSDB: Fall back to CLI flag values when retention is removed from config file. #18200
3.10.0 Feb 26, 2026 → 3.15.1 Release notes ↗ 10feature13fix

Security advisories

medium CVE-2026-44903 Stored XSS via crafted histogram bucket label values in the heatmap display of the old Prometheus web UI
7.5 CVE-2026-42151 Prometheus Azure AD remote write OAuth client secret exposed via config API
7.5 CVE-2026-42154 Remote read endpoint allows denial of service via crafted snappy payload
medium CVE-2026-40179 Stored XSS via metric names and label values in Prometheus web UI tooltips and metrics explorer
7.2 CVE-2022-46146 Basic authentication bypass
medium CVE-2021-29622 Open Redirect under the /new endpoint

Sources

See how far your stack has drifted from upstream. Release data from vendors’ own sources · feed under CC BY 4.0 · Code under AGPL-3.0 Settings Feed status