{
  "cveId": "CVE-2026-53606",
  "url": "https://patchblox.com/security/cve/CVE-2026-53606",
  "summary": "CVE-2026-53606 is fixed in 5 products on 1 platform, first by FEDORA-2026-3942AB86FD, released October 5, 2026. It is not reported as exploited. Patch Radar priority: Routine.",
  "title": "golang-github-prometheus-prometheus: This update for golang-github-prometheus-prometheus fixes the following issues:\n\ngolang-github-prometheus-prometheus...",
  "description": "This update for golang-github-prometheus-prometheus fixes the following issues:\n\ngolang-github-prometheus-prometheus was updated to version 3.13.2:\n\n- Security issues:\n\n  * CVE-2026-39821: Fixed validation bypass and privilege escalation in Punycode label handling (bsc#1266608)\n  * CVE-2026-56852: Fixed infinite loop on truncated or invalid UTF-8 input in unicode/norm handling (bsc#1272102)\n  * CVE-2026-44990: Fixed stored XSS in the new React UI by sanitizing disallowed xmp elements (bsc#1275205)\n  * CVE-2026-53606: Fixed incomplete URI scheme validation in sanitize-html that could enable XSS (bsc#1269966)\n  * CVE-2026-2303: Fixed heap out-of-bounds read in GSSAPI error handling in mongo-driver (bsc#1269856)\n  * CVE-2025-4673: Fixed credential leaks by stopping HTTP client header forwarding on redirects (bsc#1275206)\n  * CVE-2023-45289: Fixed credential leaks by stopping header and cookie forwarding on HTTP redirects (bsc#1275207)\n  * CVE-2025-61686: Fixed unauthorized file access and path traversal in react-router storage (bsc#1270711)\n  * CVE-2026-40181: Fixed open redirect risks to external domains via relative paths in react-router (bsc#1267528)\n  * CVE-2026-42342: Fixed DoS risks via unbounded path expansion in the manifest endpoint (bsc#1267538)\n  * CVE-2026-42211: Fixed remote code execution risks from prototype pollution in react-router (bsc#1267534)\n  * CVE-2026-39882: Fixed memory exhaustion via uncapped HTTP response reading in OpenTelemetry (bsc#1274221)\n  * Fixed potential denial-of-service vulnerabilities by updating the gRPC dependency\n  * Fixed memory exhaustion and DoS by rejecting snappy-compressed requests exceeding 32MB limit\n\n- Bug fixes and changes:\n\n  * Fixed scrape manager failing to reload properly when SD configuration changes rapidly.\n  * Prevent memory leak in remote-write path when the receiving endpoint is unavailable.\n  * Native Histograms are no longer experimental. They are fully supported for production workloads.\n  * Added support for OpenTelemetry traces within the Prometheus UI to correlate metrics and traces.\n  * TSDB compaction speed optimized by improving the block merging algorithm.\n  * Allow scraping of multiple targets using a single HTTP/2 connection to reduce overhead.\n  * Added new metrics to monitor the health of the rule evaluation engine.\n  * Incompatible: This affects scraping, remote read and write, alerting, and SD. Network paths might need adjustments\n    to avoid redirects.\n  * Incompatible: Rule group pagination tokens now use SHA-256 instead of MD5. Custom API consumers must adapt to the\n    new longer token format.\n  * Added \u0027group_limit\u0027 parameter to PromQL aggregations to restrict the number of results.\n  * Incompatible: promtool relative paths in config files now resolve relative to the config directory itself, instead\n    of the current working directory.\n  * Support exporting TSDB blocks directly to cloud storage via the admin API.\n  * Incompatible: Deprecated remote-write metrics like prometheus_remote_storage_samples_total are removed in favor of\n    prometheus_wal_watcher_records_read_total.\n  * Significant query performance boost for high-cardinality regex matchers.\n  * Introduce a new UI interface for safely deleting specific time series data directly.\n  * Added dynamic relabeling actions to extract substrings using regex capture groups.\n  * Fixed UI displaying incorrect time ranges after a timezone change.\n  * Bumped firewalld-prometheus-config to version 0.2 bumping OpenTelemetry to 1.43.0",
  "published": "2026-10-05T19:44:23Z",
  "severity": "low",
  "epss": 0.00211,
  "epssPercentile": 0.11459,
  "priority": "Routine",
  "priorityTier": 4,
  "exploited": false,
  "vendorExploited": false,
  "disclosed": false,
  "fixes": [
    {
      "platform": "linux",
      "product": "golang-github-prometheus-prometheus",
      "release": "sles 15.7",
      "fixedVersion": "3.13.2-150100.4.40.2",
      "fix": "SUSE-SU-2026:4606-1",
      "url": "https://patchblox.com/security/fix/linux/suse-su-2026-4606-1",
      "released": "2026-11-07T00:43:02Z"
    },
    {
      "platform": "linux",
      "product": "python-jupytext",
      "release": "Fedora 43",
      "fixedVersion": "1.19.6-1.fc43",
      "fix": "FEDORA-2026-3942AB86FD",
      "url": "https://patchblox.com/security/fix/linux/fedora-2026-3942ab86fd",
      "released": "2026-10-05T19:44:23Z"
    },
    {
      "platform": "linux",
      "product": "python-jupytext-doc",
      "release": "Fedora 43",
      "fixedVersion": "1.19.6-1.fc43",
      "fix": "FEDORA-2026-3942AB86FD",
      "url": "https://patchblox.com/security/fix/linux/fedora-2026-3942ab86fd",
      "released": "2026-10-05T19:44:23Z"
    },
    {
      "platform": "linux",
      "product": "python3-jupyterlab-jupytext",
      "release": "Fedora 43",
      "fixedVersion": "1.19.6-1.fc43",
      "fix": "FEDORA-2026-3942AB86FD",
      "url": "https://patchblox.com/security/fix/linux/fedora-2026-3942ab86fd",
      "released": "2026-10-05T19:44:23Z"
    },
    {
      "platform": "linux",
      "product": "python3-jupytext",
      "release": "Fedora 43",
      "fixedVersion": "1.19.6-1.fc43",
      "fix": "FEDORA-2026-3942AB86FD",
      "url": "https://patchblox.com/security/fix/linux/fedora-2026-3942ab86fd",
      "released": "2026-10-05T19:44:23Z"
    }
  ],
  "noFixYet": [],
  "dataAsOf": "2026-11-09T07:25:28Z",
  "attribution": {
    "text": "Data: Patchblox Patch Radar",
    "url": "https://patchblox.com/security/patch-radar",
    "terms": "https://patchblox.com/security/patch-radar/use-the-data"
  }
}