VictoriaMetrics v1.148.0 Remote Write Stream Aggregation Resource Leak Bug and Security Updates

Vulnerability Overview A bug causing increased CPU and memory usage was discovered in VictoriaMetrics v1.147.0. This issue arises when using the or flags. Although the text states the issue is present in v1.147.0, it notes that the problem was introduced in v1.148.0 and recommends upgrading to v1.148.0 or rolling back to v1.146.0. Affected Scope Affected Versions: v1.148.0 and later Trigger Condition: Using the or flags Remediation Upgrade Version: Upgrade to v1.148.0 Rollback Version: Roll back to v1.146.0 Other Important Updates Security Update: Upgraded the base Docker image (Alpine) from 3.23.4 to 3.24.1, using the Alpine 3.24.1 release notes. Feature Updates: - : Added the field to the section for JWT claim placeholders. - : Reduced CPU usage by 10% through sharding among remote storages. - : Added and alert rules. - : Allows logging requests with missing or invalid auth tokens to . - : Prevents potential password brute-force attacks by adding a 2-3 second delay. - : Improved the selection algorithm by removing consecutive empty buckets. - : Exposes the metric. - : In , exposes and metrics. - : In , added the query parameter. - : Supports to to query individual nodes from deployments. - : In , the and components cancel HTTP requests before the timeout. - : In , the and components correctly check the limit values for and flags. - : In , fixes unexpected rerouting. - : In , propagates cache reset operations to when is called. - : Fixes unexpected increases in and during stream aggregation. - : Correctly URL-encodes values when building import requests. - : Ignores the option in , as manages offset storage internally. Contributors xhebox BenNF 3 other contributors Assets 114 assets Reactions 4 reactions --- Code Block No POC code or exploit code available.

Goal Reached Thanks to every supporter — we hit 100%!

VictoriaMetrics v1.148.0 Remote Write Stream Aggregation Resource Leak Bug and Security Updates

More from this source