CVE and update status of the FreeBSD ports tree4,826 unaddressed CVEs in 618 portsAll times are CET

Port details

net-mgmt/prometheus22.55.1_20

Systems monitoring and alerting toolkit

Maintainer
dor.bsd@xm0.uk
Packages
prometheus 2.55.1_20
Upstream
Higher version available: 3.15.1
CPE
prometheus:prometheus from the port
WWW
https://prometheus.io/
Links
cgit · VuXML

Unaddressed (3) · The CVE record lists this version as affected, no VuXML entry names the CVE

CVE-2026-421517.5published 2026-05-04

Prometheus is an open-source monitoring system and time series database. Prior to versions 3.5.3 and 3.11.3, the client_secret field in the Azure AD remote write OAuth configuration (storage/remote/azuread) was typed as string instead of Secret. Prometheus redacts fields of type Secret when serving the configuration via the /-/config HTTP API endpoint. Beca…

CVE-2026-421547.5published 2026-05-04

Prometheus is an open-source monitoring system and time series database. Prior to versions 3.5.3 and 3.11.3, the remote read endpoint (/api/v1/read) does not validate the declared decoded length in a snappy-compressed request body before allocating memory. An unauthenticated attacker can send a small payload that causes a huge heap allocation per request. U…

CVE-2026-449035.1published 2026-05-26

Prometheus is an open-source monitoring system and time series database. From 2.49.0 to before 3.5.3 and 3.11.3, in the Prometheus server's legacy web UI (enabled via the command-line flag --enable-feature=old-ui), the histogram heatmap chart view does not escape le label values when inserting them into the HTML for use as axis tick mark labels. An attacker…

VuXML only (0) · listed, port not fixed yet

None. pkg audit reports nothing for this version.

Fixed (1)

VuXML entries whose affected range this version has left.

Commits (111)

Dag-Erling Smørgrav (des) · 2.55.1_20
various: Bump Go ports for Go 1.26.10 / 1.27.3
d81b7ba3c3
Dag-Erling Smørgrav (des) · 2.55.1_19
various: Bump Go ports
031fc6bfbf
Adam Weinberger (adamw) · 2.55.1_18
many: Bump go ports for 1.26.8 and 1.27.1
dd0905142a
Dag-Erling Smørgrav (des) · 2.55.1_17
various: Bump go ports for go-1.25.14 / 1.26.7
4867821cd6
Dag-Erling Smørgrav (des) · 2.55.1_16
various: Bump go ports for go-1.25.13 / 1.26.6
6d39dcf04e
Dag-Erling Smørgrav (des) · 2.55.1_15
various: Bump go ports for go-1.25.12 / 1.26.5
4ea3547132
Dag-Erling Smørgrav (des) · 2.55.1_14
various: Bump go ports for go-1.25.11 / go-1.26.4
dd8dc2a59d
Adam Weinberger (adamw) · 2.55.1_13
various: Bump ports for Go 1.25.10
4e243a83f8
Dag-Erling Smørgrav (des) · 2.55.1_12
various: Bump go ports for go-1.25.9 / 1.26.2
7507e72a84
Adam Weinberger (adamw) · 2.55.1_11
various: Bump ports for Go 1.25.8
a8d318da7c
Adam Weinberger (adamw) · 2.55.1_10
various: Bump ports for Go default 1.24->1.25
97685c1886
Adam Weinberger (adamw) · 2.55.1_9
various: Bump Go ports for 1.24.13
529df949a5
Adam Weinberger (adamw) · 2.55.1_8
various: Bump Go ports for 1.24.12
013f2d30b0
Michael Gmelin (grembo) · 2.55.1_7
net-mgmt/prometheus2: Remove go version and undeprecate

Approved by:	portmgr (blanket, just fix it)
c427538313
Adam Weinberger (adamw) · 2.55.1_6
many: Unsupported Go dep; deprecate and schedule for removal

There are about 75 ports that depend on old, unsupported Go
versions. I've scheduled those Go versions for deletions on
2025/01/01, and so these ports are scheduled for removal on
that same day.

HOWEVER....

Likely NONE or VERY VERY FEW of these ports will actually need
to be deleted! This stems from a misunderstanding:

When go.mod says "go 1.23", it means that it requires AT LEAST
go-1.23. Locking a port to a specific go version should almost
never happen; it is reserved for when a package absolutely
cannot build with any newer version, and it almost means that
the port will only last 1 year (Go releases new minors twice a
year).

Where a port has
USES=go:1.23
maintainers should attempt build with just
USES=go

If that works, please either commit it or submit it in a PR.

Same goes go
USES=go:1.23,modules
to attempt
USES=go,modules
f45b1d07f5
Adam Weinberger (adamw) · 2.55.1_6
go123 ports: Bump for 1.23.12
b6703954e3
Danilo Egea Gondolfo (danilo) · 2.55.1_5
net-mgmt/prometheus2: Set CONFLICTS_INSTALL against prometheus 1 and 3
aec3adf330
Adam Weinberger (adamw) · 2.55.1_4
go: Bump ports for go124 update
a4e30d4f4f
Adam Weinberger (adamw) · 2.55.1_3
Bump all go ports for yesterday's releases
d0642a6176
Ashish SHUKLA (ashish) · 2.55.1_2
all: Bump after lang/go123 update

PR:		284681
f9fbe03c69
Ashish SHUKLA (ashish) · 2.55.1_1
all: Bump after lang/go123 update

MFH:		2025Q1
ca07a602a8
Vladimir Druzenko (vvd) · 2.55.1
net-mgmt/prometheus2: Update 2.49.1 → 2.55.1

Changelog:
https://github.com/prometheus/prometheus/blob/v2.55.1/CHANGELOG.md

PR:	283086
bf7a57946e
Ashish SHUKLA (ashish) · 2.49.1_6
all: Bump after lang/go121 update
aa8c0111bf
Ashish SHUKLA (ashish) · 2.49.1_5
all: Bump after lang/go121 update
c4b51c2028
Ashish SHUKLA (ashish) · 2.49.1_4
all: Bump after lang/go121 update

MFH:		2024Q2
746fa696a1
Ashish SHUKLA (ashish) · 2.49.1_3
all: Bump after lang/go121 update

MFH:		2024Q2
fce0cc3272
Ashish SHUKLA (ashish) · 2.49.1_2
all: Bump after lang/go121 update

MFH:		2024Q2
32b284679a
Muhammad Moinur Rahman (bofh) · 2.49.1_1
lang/go: Change DEFAULT to 1.21

PR:		277776
Approved by:	portmgr (exp-run)
a5a000df3b
Li-Wen Hsu (lwhsu) · 2.49.1
net-mgmt/prometheus2: Update to 2.49.1 and enable Prometheus Agent mode

Changelog between these versions is available at
https://github.com/prometheus/prometheus/blob/main/CHANGELOG.md
and there are no breaking changes noted between 2.47.1 and 2.49.1.

PR:		277131, 277074
75d2f666fd
Ashish SHUKLA (ashish) · 2.47.1_2
all: Bump PORTREVISION after lang/go* update

PR:		276530
7e5aa2085f
Ashish SHUKLA (ashish) · 2.47.1_1
all: Bump PORTREVISION after lang/go* update

PR:		274405
0505b712df
Robert Clausecker (fuz) · 2.47.1
net-mgmt/prometheus2: update to 2.47.1

Changelog: https://github.com/prometheus/prometheus/blob/main/CHANGELOG.md

PR:		274326
cc09d2916a
Dmitri Goutnik (dmgk) · 2.43.0_2
all: Bump PORTREVISION after lang/go* update
8e4bc57934
Dmitri Goutnik (dmgk) · 2.43.0_1
all: Bump PORTREVISION after lang/go{119,120} update
09b993031a
Fernando Apesteguía (fernape) · 2.43.0
net-mgmt/prometheus2: update to 2.43.0

ChangeLog: https://github.com/prometheus/prometheus/blob/main/CHANGELOG.md

 * Promtool: Add HTTP client configuration to query commands.
 * Scrape: Add include_scrape_configs to include scrape configs from different
   files.
 * HTTP client: Add no_proxy to exclude URLs from proxied requests.
 * HTTP client: Add proxy_from_enviroment to read proxies from env variables.
 * API: Add support for setting lookback delta per query via the API.
 * API: Change HTTP status code from 503/422 to 499 if a request is canceled.
 * Scrape: Allow exemplars for all metric types.
 * TSDB: Add metrics for head chunks and WAL folders size.
 * TSDB: Automatically remove incorrect snapshot with index that is ahead of
   WAL.
 * TSDB: Improve Prometheus parser error outputs to be more comprehensible.
 * UI: Scope group by labels to metric in autocompletion.
 * Scrape: Fix prometheus_target_scrape_pool_target_limit metric not set before
   reloading.
 * TSDB: Correctly update prometheus_tsdb_head_chunks_removed_total and
   prometheus_tsdb_head_chunks metrics when reading WAL.
 * TSDB: Use the correct unit (seconds) when recording out-of-order append
   deltas in the prometheus_tsdb_sample_ooo_delta metric.

PR:		270914
Reported by:	David O'Rourke <dor.bsd@xm0.uk> (maintainer)
dbab10fe76
Dmitri Goutnik (dmgk) · 2.41.0_4
all: Bump PORTREVISION after lang/go{119,120} update
ff40d94c1d
Dmitri Goutnik (dmgk) · 2.41.0_3
all: Bump PORTREVISION after Go ports update
09079730e9
Dmitri Goutnik (dmgk) · 2.41.0_2
all: Bump PORTREVISION after lang/go{119,120} update
56b5ec772f
Dmitri Goutnik (dmgk) · 2.41.0_1
all: Bump PORTREVISION after GO_DEFAULT update.
2297efc51b
Fernando Apesteguía (fernape) · 2.41.0
net-mgmt/prometheus2: update to 2.41.0

ChangeLog: https://github.com/prometheus/prometheus/blob/main/CHANGELOG.md

PR:		269153
Reported by:	dor.bsd@xm0.uk (maintainer)
MFH:		2023Q1 (security fixes)
Security:	CVE-2022-46146
04ccf34437
Dmitri Goutnik (dmgk) · 2.39.1_2
all: Bump PORTVERSION after lang/go{118,119} update
3b383d833a
Dmitri Goutnik (dmgk) · 2.39.1_1
all: Bump PORTREVISION after lang/go{118,119} update
d9ad1002d5
Guangyuan Yang (ygy) · 2.39.1
net-mgmt/prometheus2: Update to 2.39.1

Changelog:	https://github.com/prometheus/prometheus/releases/tag/v2.39.1

PR:		266974
7544029577
Dmitri Goutnik (dmgk) · 2.36.0_5
all: Bump PORTREVISION after lang/go{118,119} update
bde51869ee
Dmitri Goutnik (dmgk) · 2.36.0_4
all: Bump PORTREVISION after lang/go{118,119} update
f05c98fffb
Stefan Eßer (se) · 2.36.0_3
Remove WWW entries moved into port Makefiles

Commit b7f05445c00f has added WWW entries to port Makefiles based on
WWW: lines in pkg-descr files.

This commit removes the WWW: lines of moved-over URLs from these
pkg-descr files.

Approved by:		portmgr (tcberner)
fb16dfecae
Stefan Eßer (se) · 2.36.0_3
Add WWW entries to port Makefiles

It has been common practice to have one or more URLs at the end of the
ports' pkg-descr files, one per line and prefixed with "WWW:". These
URLs should point at a project website or other relevant resources.

Access to these URLs required processing of the pkg-descr files, and
they have often become stale over time. If more than one such URL was
present in a pkg-descr file, only the first one was tarnsfered into
the port INDEX, but for many ports only the last line did contain the
port specific URL to further information.

There have been several proposals to make a project URL available as
a macro in the ports' Makefiles, over time.

This commit implements such a proposal and moves one of the WWW: entries
of each pkg-descr file into the respective port's Makefile. A heuristic
attempts to identify the most relevant URL in case there is more than
one WWW: entry in some pkg-descr file. URLs that are not moved into the
Makefile are prefixed with "See also:" instead of "WWW:" in the pkg-descr
files in order to preserve them.

There are 1256 ports that had no WWW: entries in pkg-descr files. These
ports will not be touched in this commit.

The portlint port has been adjusted to expect a WWW entry in each port
Makefile, and to flag any remaining "WWW:" lines in pkg-descr files as
deprecated.

Approved by:		portmgr (tcberner)
b7f05445c0
Dmitri Goutnik (dmgk) · 2.36.0_3
all: Bump PORTREVISION after Go update

Bump Go ports PORTREVISION after GO_DEFAULT and lang/go118 update.
4476f89764
Dmitri Goutnik (dmgk) · 2.36.0_2
all: Bump PORTREVISION after lang/go{117,118} update
153cb65ac8
Dmitri Goutnik (dmgk) · 2.36.0_1
*/*: Bump port revisons after lang/go{117,118} update
309cdeccd8