From 6b05bb0ae9bd6594493721e485461b366ad5c29e Mon Sep 17 00:00:00 2001 From: Julien Pivotto <291750+roidelapluie@users.noreply.github.com> Date: Mon, 27 Apr 2026 11:57:37 +0200 Subject: [PATCH 1/2] remote: validate snappy decoded length before allocation in read endpoint Fix CVE-2026-42154 Cherry-pick of 497f8989b from release-2.17 Jira: ACM-35487 - https://redhat.atlassian.net/browse/ACM-35487 Signed-off-by: Julien Pivotto <291750+roidelapluie@users.noreply.github.com> Co-Authored-By: Claude Opus 4.6 Signed-off-by: Kate Barreiros --- storage/remote/codec.go | 8 ++++++++ storage/remote/codec_test.go | 12 ++++++++++++ 2 files changed, 20 insertions(+) diff --git a/storage/remote/codec.go b/storage/remote/codec.go index 80bb8115003..634244d8b42 100644 --- a/storage/remote/codec.go +++ b/storage/remote/codec.go @@ -67,6 +67,14 @@ func DecodeReadRequest(r *http.Request) (*prompb.ReadRequest, error) { return nil, err } + decodedLen, err := snappy.DecodedLen(compressed) + if err != nil { + return nil, err + } + if decodedLen > decodeReadLimit { + return nil, fmt.Errorf("snappy: decoded length %d exceeds limit %d", decodedLen, decodeReadLimit) + } + reqBuf, err := snappy.Decode(nil, compressed) if err != nil { return nil, err diff --git a/storage/remote/codec_test.go b/storage/remote/codec_test.go index c92f0f8cde3..b3e9580d8d0 100644 --- a/storage/remote/codec_test.go +++ b/storage/remote/codec_test.go @@ -17,6 +17,7 @@ import ( "bytes" "fmt" "io" + "net/http" "sync" "testing" @@ -616,6 +617,17 @@ func TestMergeLabels(t *testing.T) { } } +func TestDecodeReadRequestTooLarge(t *testing.T) { + // 5-byte snappy stream whose header claims 256 MiB decoded length, + // well above decodeReadLimit (32 MiB). + bomb := []byte{0x80, 0x80, 0x80, 0x80, 0x01} + req, err := http.NewRequest(http.MethodPost, "/", bytes.NewReader(bomb)) + require.NoError(t, err) + + _, err = DecodeReadRequest(req) + require.ErrorContains(t, err, "exceeds limit") +} + func TestDecodeWriteRequest(t *testing.T) { buf, _, _, err := buildWriteRequest(nil, writeRequestFixture.Timeseries, nil, nil, nil, nil, "snappy") require.NoError(t, err) From f29af8f1adc6f07652e93f04f1b0378455c3b40e Mon Sep 17 00:00:00 2001 From: Kate Barreiros Date: Wed, 22 Jul 2026 11:05:47 +0100 Subject: [PATCH 2/2] Update CI for Go 1.25 compatibility MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit - Bump golang-builder images from 1.24-base to 1.25-base - Bump test_go_oldest from 1.23-base to 1.25-base (go.mod minimum) - Update setup-go from 1.24.x to 1.25.x (Windows, parser, golangci) - Upgrade golangci-lint from v2.1.5 to v2.4.0 (Go 1.25 support) - Fix .tekton YAML indentation (pipelineRef.params 6→4 spaces) Signed-off-by: Kate Barreiros --- .github/workflows/ci.yml | 18 +++++++++--------- .tekton/prometheus-acm-216-pull-request.yaml | 12 ++++++------ .tekton/prometheus-acm-216-push.yaml | 12 ++++++------ Makefile.common | 2 +- scripts/golangci-lint.yml | 4 ++-- 5 files changed, 24 insertions(+), 24 deletions(-) diff --git a/.github/workflows/ci.yml b/.github/workflows/ci.yml index ea10fd00912..d5ad238d8db 100644 --- a/.github/workflows/ci.yml +++ b/.github/workflows/ci.yml @@ -14,7 +14,7 @@ jobs: container: # Whenever the Go version is updated here, .promu.yml # should also be updated. - image: quay.io/prometheus/golang-builder:1.24-base + image: quay.io/prometheus/golang-builder:1.25-base steps: - uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4.2.2 with: @@ -32,7 +32,7 @@ jobs: name: More Go tests runs-on: ubuntu-latest container: - image: quay.io/prometheus/golang-builder:1.24-base + image: quay.io/prometheus/golang-builder:1.25-base steps: - uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4.2.2 with: @@ -55,7 +55,7 @@ jobs: GOTOOLCHAIN: local container: # The go version in this image should be N-1 wrt test_go. - image: quay.io/prometheus/golang-builder:1.23-base + image: quay.io/prometheus/golang-builder:1.25-base steps: - uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4.2.2 with: @@ -70,7 +70,7 @@ jobs: # Whenever the Go version is updated here, .promu.yml # should also be updated. container: - image: quay.io/prometheus/golang-builder:1.24-base + image: quay.io/prometheus/golang-builder:1.25-base steps: - uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4.2.2 @@ -97,7 +97,7 @@ jobs: persist-credentials: false - uses: actions/setup-go@0aaccfd150d50ccaeb58ebd88d36e91967a5f35b # v5.4.0 with: - go-version: 1.24.x + go-version: 1.25.x - run: | $TestTargets = go list ./... | Where-Object { $_ -NotMatch "(github.com/prometheus/prometheus/config|github.com/prometheus/prometheus/web)"} go test $TestTargets -vet=off -v @@ -109,7 +109,7 @@ jobs: # Whenever the Go version is updated here, .promu.yml # should also be updated. container: - image: quay.io/prometheus/golang-builder:1.24-base + image: quay.io/prometheus/golang-builder:1.25-base steps: - uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4.2.2 with: @@ -208,7 +208,7 @@ jobs: uses: actions/setup-go@0aaccfd150d50ccaeb58ebd88d36e91967a5f35b # v5.4.0 with: cache: false - go-version: 1.24.x + go-version: 1.25.x - name: Run goyacc and check for diff run: make install-goyacc check-generated-parser golangci: @@ -222,7 +222,7 @@ jobs: - name: Install Go uses: actions/setup-go@0aaccfd150d50ccaeb58ebd88d36e91967a5f35b # v5.4.0 with: - go-version: 1.24.x + go-version: 1.25.x - name: Install snmp_exporter/generator dependencies run: sudo apt-get update && sudo apt-get -y install libsnmp-dev if: github.repository == 'prometheus/snmp_exporter' @@ -231,7 +231,7 @@ jobs: with: args: --verbose # Make sure to sync this with Makefile.common and scripts/golangci-lint.yml. - version: v2.1.5 + version: v2.4.0 fuzzing: uses: ./.github/workflows/fuzzing.yml if: github.event_name == 'pull_request' diff --git a/.tekton/prometheus-acm-216-pull-request.yaml b/.tekton/prometheus-acm-216-pull-request.yaml index ebe0efdd69b..a59bf646adf 100644 --- a/.tekton/prometheus-acm-216-pull-request.yaml +++ b/.tekton/prometheus-acm-216-pull-request.yaml @@ -43,12 +43,12 @@ spec: pipelineRef: resolver: git params: - - name: url - value: "https://github.com/stolostron/konflux-build-catalog.git" - - name: revision - value: main - - name: pathInRepo - value: pipelines/common.yaml + - name: url + value: "https://github.com/stolostron/konflux-build-catalog.git" + - name: revision + value: main + - name: pathInRepo + value: pipelines/common.yaml taskRunTemplate: serviceAccountName: build-pipeline-prometheus-acm-216 workspaces: diff --git a/.tekton/prometheus-acm-216-push.yaml b/.tekton/prometheus-acm-216-push.yaml index 6bc50f43b0a..2371915b7fe 100644 --- a/.tekton/prometheus-acm-216-push.yaml +++ b/.tekton/prometheus-acm-216-push.yaml @@ -43,12 +43,12 @@ spec: pipelineRef: resolver: git params: - - name: url - value: "https://github.com/stolostron/konflux-build-catalog.git" - - name: revision - value: main - - name: pathInRepo - value: pipelines/common.yaml + - name: url + value: "https://github.com/stolostron/konflux-build-catalog.git" + - name: revision + value: main + - name: pathInRepo + value: pipelines/common.yaml taskRunTemplate: serviceAccountName: build-pipeline-prometheus-acm-216 workspaces: diff --git a/Makefile.common b/Makefile.common index 4de21512ffb..8ba1d640628 100644 --- a/Makefile.common +++ b/Makefile.common @@ -61,7 +61,7 @@ PROMU_URL := https://github.com/prometheus/promu/releases/download/v$(PROMU_ SKIP_GOLANGCI_LINT := GOLANGCI_LINT := GOLANGCI_LINT_OPTS ?= -GOLANGCI_LINT_VERSION ?= v2.1.5 +GOLANGCI_LINT_VERSION ?= v2.4.0 GOLANGCI_FMT_OPTS ?= # golangci-lint only supports linux, darwin and windows platforms on i386/amd64/arm64. # windows isn't included here because of the path separator being different. diff --git a/scripts/golangci-lint.yml b/scripts/golangci-lint.yml index 672dd424d61..6d317a4782a 100644 --- a/scripts/golangci-lint.yml +++ b/scripts/golangci-lint.yml @@ -28,7 +28,7 @@ jobs: - name: Install Go uses: actions/setup-go@0aaccfd150d50ccaeb58ebd88d36e91967a5f35b # v5.4.0 with: - go-version: 1.24.x + go-version: 1.25.x - name: Install snmp_exporter/generator dependencies run: sudo apt-get update && sudo apt-get -y install libsnmp-dev if: github.repository == 'prometheus/snmp_exporter' @@ -36,4 +36,4 @@ jobs: uses: golangci/golangci-lint-action@1481404843c368bc19ca9406f87d6e0fc97bdcfd # v7.0.0 with: args: --verbose - version: v2.1.5 + version: v2.4.0