Prometheus v3.15.1 released on 21-10-2026
Prometheus v3.15.1 is out now. It updates container images to explicitly distrust the “emSign ECC Root CA – G3” and “Comodo AAA Services root” after the compromise of eMudhra intermediate CA private keys, and includes rebuilt binaries and library updates that address multiple Go standard-library and HTTP/2 vulnerabilities.
Users should consult the Prometheus GitHub release notes or the project’s official pages for full details and upgrade instructions.
What’s in this release
- Container images: CA bundle updated to explicitly distrust “emSign ECC Root CA – G3” and “Comodo AAA Services root” following the eMudhra intermediate CA private key compromise.
- Binaries rebuilt with Go 1.27.3 to fix vulnerabilities in net/http, net/textproto, crypto/tls and html/template.
- Dependency golang.org/x/net bumped to v0.60.0 to remediate multiple HTTP/2 vulnerabilities (GO-2026-6603, GO-2026-6610, GO-2026-6611, GO-2026-6612, GO-2026-6617).
Upgrade notes
- Upgrade container images to v3.15.1; check any integrations that relied on certificates chaining to the distrusted roots and replace or reissue those certificates where necessary.
- Rebuild custom Prometheus builds with Go 1.27.3 or later to incorporate the standard-library fixes. The release notes do not provide explicit rollback guidance, so plan upgrades accordingly.
Share your experience with the upgrade — report issues or observations on the Prometheus GitHub or community channels so others can benefit.
