Uncontrolled Resource Consumption in promhttp

published 2022-02-15 4 y ago modified 2026-09-10 1 mo ago also GHSA-cg3q-j54f-5p7p , GO-2022-0322 , EUVD-2022-0960

cvss: 7.5; version 3.1, CNA
cisa kev: Not listed; not in CISA's catalog
epss: 6.0%; EPSS 6.0% chance of exploitation in 30 days, percentile 93%
public exploits: 0; none known

client_golang is the instrumentation library for Go applications in Prometheus, and the promhttp package in client_golang provides tooling around HTTP servers and clients. In client_golang prior to version 1.11.1, HTTP server is susceptible to a Denial of Service through unbounded cardinality, and potential memory exhaustion, when handling requests with non-standard HTTP methods. In order to be affected, an instrumented software must use any of `promhttp.InstrumentHandler*` middleware except `RequestsInFlight`; not filter any specific methods (e.g GET) before middleware; pass metric with `method` label name to our middleware; and not have any firewall/LB/proxy that filters away requests with unknown `method`. client_golang version 1.11.1 contains a patch for this issue. Several workarounds are available, including removing the `method` label name from counter/gauge used in the InstrumentHandler; turning off affected promhttp handlers; adding custom middleware before promhttp handler that will sanitize the request method given by Go http.Request; and using a reverse proxy or web application firewall, configured to only allow a limited set of methods.

Vendor advisories

What the vendors themselves say about their products: affected, fixed or not affected, and what to do.

red hat product security vex CVE-2022-21698 updated 2026-11-07 cvss 7.5

prometheus/client_golang: Denial of service using InstrumentHandlerCounter

Red Hat Cost Management Metrics Operator costmanagement/costmanagement-metrics-rhel8-operator Red Hat Migration Toolkit for Containers rhmtc/openshift-velero-plugin-rhel8, rhmtc/openshift-migration-velero-rhel8, rhmtc/openshift-migration-controller-rhel8, rhmtc/openshift-migration-velero-restic-restore-helper-rhel8 Red Hat Migration Toolkit for Virtualization migration-toolkit-virtualization/mtv-controller-rhel9
affected: no fix available
Red Hat OpenShift Developer Tools and Services odo, helm, source-to-image-container, jenkins-operator-container, ocp-tools-4/service-binding-rhel8-operator
affected: no fix available, no fix planned “Will not fix”
Red Hat OpenShift Pipelines openshift-pipelines-client Red Hat OpenShift Serverless openshift-serverless-1/openshift-serverless-1-eventing-kafka-channel-webhook-rhel8
affected: no fix planned “Will not fix”
Red Hat OpenShift Service Mesh 2.0 servicemesh, servicemesh-mixc, servicemesh-mixs, servicemesh-grafana, servicemesh-istioctl, servicemesh-operator, +4 more
affected: no fix available
Red Hat OpenShift Service Mesh 2.1 servicemesh, servicemesh-cni, servicemesh-grafana, servicemesh-pilot-agent, servicemesh-pilot-discovery, openshift-service-mesh/kiali-rhel8
affected: no fix planned “Will not fix”
Red Hat 3scale API Management Platform 2 3scale-amp26/3scale-operator, 3scale-amp2/apicast-rhel9-operator Red Hat Advanced Cluster Management for Kubernetes 2 client_golang Red Hat AMQ Broker 7 ansible-automation-platform-24/controller-rhel8-operator
affected: no fix available
Red Hat Enterprise Linux 7 podman, buildah Red Hat Enterprise Linux 8 podman, skopeo, buildah, podman-tests, skopeo-tests, buildah-tests, +7 more
affected: no fix planned “Out of support scope”
Red Hat OpenShift Container Platform 3.11 atomic-openshift, openshift3/grafana, atomic-openshift-pod, atomic-openshift-node, atomic-openshift-tests, atomic-openshift-master, +11 more
affected: no fix available, no fix planned “Will not fix”

show 18 more

Red Hat OpenShift Container Platform 4 podman, skopeo, openshift, podman-tests, skopeo-tests, podman-docker, +88 more
affected: no fix available, no fix planned “Out of support scope”
Red Hat OpenShift Container Platform Assisted Installer 1 rhai-tech-preview/assisted-installer-rhel8 Red Hat OpenShift distributed tracing 2 rhosdt/opentelemetry-rhel8-operator, rhosdt/opentelemetry-collector-rhel8
affected: no fix available
Red Hat OpenShift GitOps openshift-gitops-1/argocd-rhel8, openshift-gitops-1/gitops-rhel8, openshift-gitops-1/applicationset-rhel8, openshift-gitops-1/openshift-gitops-operator
affected: no fix available, no fix planned “Will not fix”
Red Hat OpenShift Virtualization 2 kubevirt, kubemacpool-container, virt-launcher-container, ovs-cni-plugin-container, virt-cdi-cloner-container, vm-import-virtv2v-container, +8 more
affected: no fix planned “Will not fix”
Red Hat OpenShift Virtualization 4 container-native-virtualization/kubemacpool, container-native-virtualization/virt-launcher, container-native-virtualization/libguestfs-tools, container-native-virtualization/virt-launcher-rhel9, container-native-virtualization/virt-cdi-cloner-rhel9, container-native-virtualization/vm-import-virtv2v-rhel8, +6 more
affected: no fix available, no fix planned “Will not fix”
Red Hat OpenStack Platform 16.1 smart-gateway-container
affected: no fix planned “Out of support scope”
Red Hat Quay 3 quay/quay-rhel8, quay/clair-rhel8, quay-bridge-operator, quay/quay-builder-rhel8, quay/quay-operator-rhel8, quay/quay-container-security-operator-rhel8
affected: no fix available, no fix planned “Will not fix”
Red Hat Service Telemetry Framework 1.3 for RHEL 8 stf/sg-core-rhel8 Red Hat Service Telemetry Framework 1.5 stf/sg-core-rhel8
affected: no fix planned “Will not fix”
Red Hat Advanced Cluster Management for Kubernetes 2 rhacm2/work-rhel8, rhacm2/search-rhel8, rhacm2/subctl-rhel9, rhacm2/thanos-rhel7, rhacm2/volsync-rhel8, rhacm2/placement-rhel8, +57 more Red Hat Advanced Cluster Security 3 advanced-cluster-security/rhacs-docs-rhel8, advanced-cluster-security/rhacs-main-rhel8, advanced-cluster-security/rhacs-scanner-rhel8 Red Hat Ceph Storage 4 rhceph/rhceph-4-dashboard-rhel8 Red Hat Ceph Storage 5 rhceph/rhceph-5-dashboard-rhel8 Red Hat Openshift Container Storage 4 mcg, ocs4/cephcsi-rhel8, ocs4/mcg-rhel8-operator, odf4/ocs-rhel9-operator, ocs4/rook-ceph-rhel8-operator, ocs4/volume-replication-rhel8-operator Red Hat Quay 3 quay/quay-openshift-bridge-rhel8-operator
under investigation
Red Hat CNV 4.10 for RHEL 7 kubevirt 4.10.1-489.el7, kubevirt-virtctl 4.10.1-489.el7, kubevirt-virtctl-redistributable 4.10.1-489.el7 Red Hat CNV 4.10 for RHEL 8 kubevirt 4.10.1-489.el8, kubevirt-virtctl 4.10.1-489.el8, kubevirt-virtctl-redistributable 4.10.1-489.el8, container-native-virtualization/hostpath-csi-driver v4.10.2-1, container-native-virtualization/hostpath-csi-driver-rhel8 v4.10.2-1
fixed: vendor fix RHSA-2022:4667
Red Hat Middleware Containers for OpenShift amq7/amq-broker-rhel8-operator 7.12.0-16, amq7/amq-broker-rhel8-operator-bundle 7.12.0-10
fixed: vendor fix RHSA-2024:2944
Red Hat multicluster engine for Kubernetes 2.6 multicluster-engine
fixed: vendor fix RHSA-2025:23528
Red Hat multicluster engine for Kubernetes 2.7 multicluster-engine
fixed: vendor fix RHSA-2025:22683
Red Hat multicluster engine for Kubernetes 2.8 multicluster-engine 1766274324
fixed: vendor fix RHSA-2026:0722
Red Hat OpenShift API for Data Protection 1.0 oadp/oadp-registry-rhel8 1.0.4-6, oadp/oadp-rhel8-operator 1.0.5-16, oadp/oadp-mustgather-rhel8 1.0.5-20
fixed: vendor fix RHSA-2022:7261
Red Hat OpenShift API for Data Protection 1.1 oadp/oadp-velero-rhel8 1.1.6-7, oadp/oadp-velero-plugin-rhel8 1.1.0-20
fixed: vendor fix RHSA-2022:6290
Red Hat OpenShift Logging 5.2 openshift-logging/elasticsearch-proxy-rhel8 v1.0.0-168, openshift-logging/elasticsearch-rhel8-operator v5.2.10-5
fixed: vendor fix RHSA-2022:2218
Red Hat OpenShift Logging 5.3 openshift-logging/elasticsearch-proxy-rhel8 v1.0.0-171, openshift-logging/elasticsearch-rhel8-operator v5.3.7-5
fixed: vendor fix RHSA-2022:2217

19 more fixed, 30 more not affected in the full advisory

Red Hat CSAF VEX © Red Hat, Inc., from https://security.access.redhat.com/data/csaf/v2/vex/; changed: reduced to product statuses and remediations. CC BY 4.0 · csaf

CISA SSVC

Exploitation: none
Automatable: yes
Technical impact: partial
Assessed: 18 mo ago (2025-04-23)

Exploit prediction

5.99% chance of exploitation in the next 30 days, higher than 93% of all scored CVEs (FIRST EPSS, 2026-11-08).

CVSS scores

assigned by	version	score	vector
CNA	3.1	7.5	CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
NVD	3.1	7.5	CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
NVD	2.0	5.0	AV:N/AC:L/Au:N/C:N/I:N/A:P
GitHub	3.1	7.5	CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

Affected packages

ecosystem	package	affected	fixed in
go	github.com/prometheus/client_golang	<1.11.1	1.11.1

Affected products

prometheus client_golang

Classification

Weakness

CWE-400 Uncontrolled Resource Consumption
CWE-770 Allocation of Resources Without Limits or Throttling
CWE-772 Missing Release of Resource after Effective Lifetime

References

Sources

Fencer Vulns keeps one entry per vulnerability: the CVE id wins, then GHSA, and records that alias each other are merged, except that two CVEs always keep separate entries. The same data is available as JSON.

Summary

Patch / fix