Prometheus 3.13.4 releases security fixes and histogram bugfixes

Brief written by the FOSSWire AI editor from Prometheus How we write

October 2, 2026 1 min read 22 reads

Key Takeaway

Prometheus 3.13.4 addresses a memory exhaustion vulnerability in gRPC and fixes several histogram-related bugs.

Summary

The Prometheus 3.13.4 release includes critical security updates to address memory exhaustion via HTTP/2 DATA frame fragmentation. It also resolves issues with float native histogram corruption in federation and fixes scraping failures for specific protobuf float histograms.

Technical changes in Prometheus 3.13.4

Security: Updated google.golang.org/grpc to v1.83.1 to mitigate memory exhaustion (GO-2026-6348).
Security: Updated vulnerable npm dependencies in the UI.
Agent: Modified the agent to ignore unknown WAL record types, enabling rollbacks from newer versions.
Bugfix: Resolved corruption issues affecting float native histograms during federation.
Bugfix: Fixed scraping failures for protobuf float histograms containing zero sample, zero, and bucket counts.

Why it matters

The security patch for gRPC is important for users running Prometheus in environments where HTTP/2 traffic could be manipulated to cause resource exhaustion.

Original reference: github.com →