Skip to content

remote: validate snappy decoded length before allocation in write endpoint#18591

Merged
roidelapluie merged 1 commit into
prometheus:release-3.5from
roidelapluie:roidelapluie/rw-decode-limit
Apr 27, 2026
Merged

remote: validate snappy decoded length before allocation in write endpoint#18591
roidelapluie merged 1 commit into
prometheus:release-3.5from
roidelapluie:roidelapluie/rw-decode-limit

Conversation

@roidelapluie
Copy link
Copy Markdown
Member

Which issue(s) does the PR fix:

Release notes for end users (ALL commits must be considered).

Reviewers should verify clarity and quality.

[SECURITY] Remote-Write: Reject snappy-compressed requests whose declared decoded length exceeds the decode limit

…point

Signed-off-by: Julien Pivotto <291750+roidelapluie@users.noreply.github.com>
Copy link
Copy Markdown
Member

@krajorama krajorama left a comment

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

LGTM technically breaking in some edge cases , so let's mention CHANGE in release notes as well. If someone was sending msg close to 32mb

@roidelapluie roidelapluie merged commit cbcbf1f into prometheus:release-3.5 Apr 27, 2026
31 checks passed
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

2 participants