Explore top 10 tips to secure your open-source projects now. Read More

×
Alerts This Week
Warning Icon 1 438
Alerts This Week
Warning Icon 1 438

SUSE golang-github-prometheus-prometheus Key Security Update 2026-20232-1

suse
Calendar Grey February 11, 2026
Dist Suse Esm H88
A security update for golang-github-prometheus-prometheus in SUSE fixes two vulnerabilities and enhances features effectively.
An update that solves two vulnerabilities and contains one feature can now be installed.

Summary

## This update for golang-github-prometheus-prometheus fixes the following issues: Update to version 3.5.0: Security issues fixed: * CVE-2025-13465: prototype pollution in the _.unset and_.omit functions can lead to deletion of methods from global (bsc#1257329). * CVE-2025-12816: interpretation conflict vulnerability allowing bypassing cryptographic verifications (bsc#1255588). Other updates and bugfixes: * Update to 3.5.0 (jsc#PED-13824): * [FEATURE] Remote-write: Add support for Azure Workload Identity as an authentication method for the receiver. * [FEATURE] PromQL: Add first_over_time(...) and ts_of_first_over_time(...) behind feature flag. * [FEATURE] Federation: Add support for native histograms with custom buckets (NHCB).

Topics%20covered

Topics Covered

security advisory SuSE remote code execution cross site scripting important interpretation conflict

References

* bsc#1255588

* bsc#1257329

* jsc#PED-13824

Cross-

* CVE-2025-12816

* CVE-2025-13465

CVSS scores:

* CVE-2025-12816 ( SUSE ): 8.6 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:N/I:H/A:N

* CVE-2025-12816 ( NVD ): 8.6 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:N/I:H/A:N

* CVE-2025-13465 ( SUSE ): 8.8

CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:L/VA:H/SC:N/SI:N/SA:N

* CVE-2025-13465 ( SUSE ): 8.2 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:H

* CVE-2025-13465 ( NVD ): 6.9

CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:L/VA:L/SC:H/SI:H/SA:H/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

Affected Products:

* SUSE Linux Enterprise Server 16.0

* SUSE Linux Enterprise Server for SAP Applications 16.0

Severity
important
Lowest
Low
Medium
High
Critical

Announcement ID: SUSE-SU-2026:20232-1
Release Date: 2026-02-05T10:44:24Z
Rating: important

Topics%20covered

Topics Covered

security advisory SuSE remote code execution cross site scripting important interpretation conflict

Get the latest News and Insights

Get the latest Linux and open source security news straight to your inbox.