This vulnerability in Prometheus' remote read endpoint handles SNAPPY-compressed payloads without verifying the decoded length prior to allocating memory. An attacker can exploit this by sending a small, carefully crafted payload that forces the server to allocate an enormous amount of heap space. The resulting memory exhaustion can cause the Prometheus process to crash, leading to denial of service. The weakness is a classic case of resource exhaustion and improper input validation (CWE-400, CWE-770, CWE-789).

The issue affects all instances of Prometheus running versions older than 3.5.3 and 3.11.3. The vendor recommends updating to either 3.5.3 or 3.11.3 where the check has been added and the allocation guard is in place.

The CVSS score is 7.5, indicating a high severity for availability impact. The EPSS score is 0.0002, indicating a very low projected probability of exploitation (<1%). The vulnerability requires only unauthenticated network access to the /api/v1/read endpoint, which is commonly exposed. The attack can be launched remotely by an adversary capable of sending HTTP requests, and under concurrent load it can exhaust system memory quickly. As the vulnerability is not listed in CISA's KEV catalog, there is currently no widespread evidence of exploitation, but the potential for disruption remains high.