GHSA-q7rr-3cgh-j5r3
High · 7.5CVSS
7.5
EPSS
—
Published
May 11, 2026
CISA due date
—
The record
Prometheus exporter process crash via malformed HTTP request
Affected packages
| Ecosystem | Package | Introduced | Fixed |
|---|---|---|---|
| npm | @opentelemetry/auto-instrumentations-node | 0 | 0.75.0 |
| npm | @opentelemetry/exporter-prometheus | 0 | 0.217.0 |
| npm | @opentelemetry/sdk-node | 0 | 0.217.0 |
Related vulnerabilities
- CVE-2026-44902 opentelemetry-js is the OpenTelemetry JavaScript Client. Same vulnerability
- CVE-2026-109618 PHP uses longjmp() for out-of-memory (OOM) errors to exit the current context and abort… CWE-755
- CVE-2026-109619 PHP has various global state that temporarily points into request memory. CWE-755
- CVE-2026-105757 vLLM is an inference and serving engine for large language models. CWE-755
- CVE-2026-102274 PyJWT is a Python implementation of JSON Web Token standards. CWE-755
- CVE-2026-49305 Permission control vulnerability in the Wi-Fi enhancement module. Impact: Successful… CWE-755
- CVE-2026-45819 baseline-browser-mapping 2.x before 2.11.0 calls process.exit() instead of throwing on… CWE-755
- CVE-2026-52856 Wings is the server control plane for Pterodactyl, a free, open-source game server… CWE-755