# Prometheus 3.15.1 patches CA certificate and Go HTTP/2 vulnerabilities

> **Key takeaway:** Prometheus 3.15.1 is a security-only release that updates CA certificates to distrust compromised roots and rebuilds with patched Go and x/net libraries.

**Published:** 2026-10-21T16:15:57+00:00 
**Source:** Prometheus Monitoring System 
**Category:** cloud-native 
**Canonical URL:** https://fosswire.org/news/prometheus-3151-patches-ca-certificate-and-go-http2-vulnerab.html 

## Summary
Prometheus 3.15.1 ships three security fixes with no functional changes. Container images now distrust two root CAs after eMudhra intermediate key compromise. The release builds with Go 1.27.3 to address vulnerabilities in net/http, net/textproto, crypto/tls and html/template. The golang.org/x/net dependency bumps to v0.60.0 for five tracked HTTP/2 CVEs.

## What Prometheus 3.15.1 patches
- **CA certificate distrust**: Removes trust for "emSign ECC Root CA - G3" and "Comodo AAA Services root" after eMudhra intermediate CA private key compromise
- **Go 1.27.3 rebuild**: Fixes vulnerabilities in `net/http`, `net/textproto`, `crypto/tls`, and `html/template` standard library packages
- **golang.org/x/net v0.60.0**: Addresses five HTTP/2 vulnerabilities tracked as GO-2026-6603, GO-2026-6610, GO-2026-6611, GO-2026-6612, and GO-2026-6617

## Why it matters
Prometheus is a core dependency of most Kubernetes and cloud-native observability stacks. The CA distrust and HTTP/2 fixes affect any deployment scraping TLS endpoints or exposed to external query traffic.