CVE-2022-21698: Uncontrolled Resource Consumption in promhttp
Summary
CVE-2022-21698: Uncontrolled resource consumption in github.com/prometheus/client_golang. Affects github.com/prometheus/client_golang versions < 1.11.1. Fixed in 1.11.1. How to fix ↓
Also tracked for
- golang-github-prometheus-client-golang · Debian:11
The same CVE-2022-21698 is tracked separately for each ecosystem and vendor. Its fix information is the same; the package and affected versions differ.
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
The package under scrutiny is github.com/prometheus/client_golang, which is the Go client library for Prometheus. It consists of two parts: one for instrumenting application code and another for creating clients that communicate with the Prometheus HTTP API. The promhttp package in client_golang provides tooling for HTTP servers and clients.
This vulnerability affects the HTTP server in the promhttp package, making it susceptible to a Denial of Service (DoS) attack through unbounded cardinality and potential memory exhaustion. The vulnerability arises when handling requests with non-standard HTTP methods.
Vulnerability Detail
The vulnerability in the promhttp package allows an attacker to launch a DoS attack on the HTTP server. By exploiting unbounded cardinality and potential memory exhaustion, an attacker can overwhelm the server and render it unresponsive. This vulnerability can have severe consequences, including service disruption and resource exhaustion.
To be affected, an instrumented software must use any of the promhttp.InstrumentHandler* middleware (except RequestsInFlight), not filter any specific methods before the middleware, pass a metric with the method label name to the middleware, and not have any firewall/LB/proxy that filters requests with unknown methods.
How To Fix
Minimum fixed version
1.11.1
This is the first release that contains the fix.
go get github.com/prometheus/client_golang@v1.11.1Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
If upgrading to version 1.11.1 or above is not feasible, the following workarounds can be implemented:
- Remove the
methodlabel name from the counter/gauge used in theInstrumentHandler. - Turn off the affected
promhttphandlers. - Add custom middleware before the
promhttphandler to sanitize the request method given byhttp.Request. - Use a reverse proxy or web application firewall configured to only allow a limited set of methods.
Conclusion
The github.com/prometheus/client_golang package is vulnerable to a DoS attack due to uncontrolled resource consumption in the promhttp package. Upgrading to version 1.11.1 or above is the recommended solution, but if that is not possible, workarounds can be implemented. It is crucial to take appropriate measures to mitigate the risk of a DoS attack and ensure the stability and availability of the HTTP server.
See every vulnerability recorded for github.com/prometheus/client_golang →
FAQ
The vulnerability can lead to a Denial of Service (DoS) attack on the HTTP server, causing service disruption and potential resource exhaustion.
To fix this vulnerability, it is recommended to upgrade to version 1.11.1 or above of the github.com/prometheus/client_golang package.
Yes, if upgrading is not feasible, you can implement workarounds such as removing the method label name, turning off affected promhttp handlers, adding custom middleware, or using a reverse proxy or web application firewall.
To be affected, an instrumented software must use specific middleware, not filter specific methods, pass a metric with the method label name, and not have any firewall/LB/proxy that filters requests with unknown methods.
For more information, you can open an issue in the https://github.com/prometheus/client_golang or email prometheus-team@googlegroups.com.
