# Prometheus 3.13.5 patches multiple security flaws in CA certs, Go runtime, HTTP/2

> **Key takeaway:** Prometheus 3.13.5 is a security-focused release that distrusts compromised root CAs, updates Go to fix vulnerabilities in net/http, crypto/tls and html/template, and patches five HTTP/2 CVEs.

**Published:** 2026-10-21T12:06:36+00:00 
**Source:** Prometheus Monitoring System 
**Category:** cloud-native 
**Canonical URL:** https://fosswire.org/news/prometheus-3135-patches-multiple-security-flaws-in-ca-certs-.html 

## Summary
Prometheus 3.13.5 ships with four security fixes and one build requirement change. Container images now distrust two root CAs after an intermediate CA key compromise. The release builds with Go 1.26.10 and updates golang.org/x/net to v0.60.0 to address HTTP/2 and standard library vulnerabilities. OpenTelemetry is bumped to v1.45.0 to prevent exporter endpoint URL leakage into logs. Building from source now requires Go 1.26 or later.

## What the security fixes address
- **CA certificate distrust**: Removes trust for "emSign ECC Root CA - G3" and "Comodo AAA Services root" after eMudhra intermediate CA private key compromise
- **Go 1.26.10 runtime fixes**: Patches vulnerabilities in `net/http`, `net/textproto`, `crypto/tls`, and `html/template` packages
- **golang.org/x/net v0.60.0**: Fixes five HTTP/2 vulnerabilities tracked as GO-2026-6603, GO-2026-6610, GO-2026-6611, GO-2026-6612, and GO-2026-6617
- **OpenTelemetry v1.45.0**: Resolves info log leakage of exporter endpoint URLs (GO-2026-6505)
- **Build requirement**: Minimum Go version raised from previous requirement to Go 1.26

## Why it matters
Prometheus is a core component of cloud-native monitoring stacks; these security fixes affect anyone running Prometheus in production, particularly organizations using container images or building from source. The CA distrust change may break TLS connections to services chaining through the affected roots.