Prometheus 3.15.1 patches CA certificate and Go HTTP/2 vulnerabilities

Brief written by the FOSSWire AI editor from Prometheus How we write

October 21, 2026 1 min read 3 reads

Key Takeaway

Prometheus 3.15.1 is a security-only release that updates CA certificates to distrust compromised roots and rebuilds with patched Go and x/net libraries.

Summary

Prometheus 3.15.1 ships three security fixes with no functional changes. Container images now distrust two root CAs after eMudhra intermediate key compromise. The release builds with Go 1.27.3 to address vulnerabilities in net/http, net/textproto, crypto/tls and html/template. The golang.org/x/net dependency bumps to v0.60.0 for five tracked HTTP/2 CVEs.

What Prometheus 3.15.1 patches

CA certificate distrust: Removes trust for "emSign ECC Root CA - G3" and "Comodo AAA Services root" after eMudhra intermediate CA private key compromise
Go 1.27.3 rebuild: Fixes vulnerabilities in net/http, net/textproto, crypto/tls, and html/template standard library packages
golang.org/x/net v0.60.0: Addresses five HTTP/2 vulnerabilities tracked as GO-2026-6603, GO-2026-6610, GO-2026-6611, GO-2026-6612, and GO-2026-6617

Why it matters

Prometheus is a core dependency of most Kubernetes and cloud-native observability stacks. The CA distrust and HTTP/2 fixes affect any deployment scraping TLS endpoints or exposed to external query traffic.

Original reference: github.com →