VictoriaMetrics

v1.122.24 Security

This release includes 1 security fix for security teams reviewing exposed deployments.

Published 1mo Monitoring & Metrics

View tool

✓ No known CVEs patched

Read the diff → Tool health → What is this tool? →

This release patches 1 known CVE

Topics

database grafana graphite influxdb kubernetes monitoring

+7 more

observability opentelemetry opentsdb prometheus promql thanos tsdb

Affected surfaces

deps

ReleasePort's take

Moderate signal

editorial:auto 1mo

Upgrade the Go builder to version 1.26.4 as part of this release.

Why it matters: The update addresses a critical security issue in the build environment; upgrade immediately if using Go 1.26.3.

Summary

AI summary

Updates BUGFIX, https://docs.victoriametrics.com/victoriametrics/cluster-victoriametrics/, and https://docs.victoriametrics.com/victoriametrics/enterprise/ across a mixed release.

Changes in this release

Type	Severity	Summary	CVE
Security	Critical	Upgrade Go builder from Go1.26.3 to Go1.26.4. Upgrade Go builder from Go1.26.3 to Go1.26.4. Source: llm_adapter@2026-06-08 Confidence: high	—
Bugfix
Bugfix	Medium	`integrate()` no longer extrapolates the last sample's value past series end. `integrate()` no longer extrapolates the last sample's value past series end. Source: llm_adapter@2026-06-08 Confidence: high	—
Bugfix	Medium	vmalert resets group evaluation timestamp if it exceeds current host time. vmalert resets group evaluation timestamp if it exceeds current host time. Source: llm_adapter@2026-06-08 Confidence: high	—
Bugfix	Medium	vmselect avoids HTTP 503 for queries with partial results when a storage group is unavailable and `-search.denyPartialResponse` is disabled. vmselect avoids HTTP 503 for queries with partial results when a storage group is unavailable and `-search.denyPartialResponse` is disabled. Source: llm_adapter@2026-06-08 Confidence: high	—
Bugfix	Medium	vmselect and vmsingle properly escape utf-8 label names for `/federate` API requests. vmselect and vmsingle properly escape utf-8 label names for `/federate` API requests. Source: llm_adapter@2026-06-08 Confidence: high	—
Bugfix	Medium	vmselect fixes intermittent `write: connection timed out` errors caused by silently dropped TCP connections reused from the pool. vmselect fixes intermittent `write: connection timed out` errors caused by silently dropped TCP connections reused from the pool. Source: llm_adapter@2026-06-08 Confidence: high	—

Full changelog

v1.122.24

Released at 2026-06-05

v1.122.x is a line of LTS releases. It contains important up-to-date bugfixes for VictoriaMetrics enterprise.
All these fixes are also included in the latest community release.
The v1.122.x line will be supported for at least 12 months since v1.122.0 release

SECURITY: upgrade Go builder from Go1.26.3 to Go1.26.4. See the list of issues addressed in Go1.26.4.
BUGFIX: MetricsQL: integrate() no longer extrapolates the last sample's value past the end of the time series. Previously, querying integrate(metric[1h]) at a timestamp where the series had already ended would keep accruing area as if the last value continued indefinitely, producing values much larger than the true integral. See #9474. Thanks to @wtfashwin for contribution.
BUGFIX: vmalert: reset the group evaluation timestamp if it exceeds the current host time. Previously, vmalert could use future timestamps for evaluations if the system clock was shifted backward. See #10985.
BUGFIX: vmselect in VictoriaMetrics cluster: avoid returning HTTP 503 for queries with partial results when a storage group is unavailable and -search.denyPartialResponse is disabled. See #11009. Thanks to @fxrlv for the contribution.
BUGFIX: vmsingle and vmselect in VictoriaMetrics cluster: properly escape utf-8 label names for /federate API requests. See #10968.
BUGFIX: vmselect in VictoriaMetrics cluster: fix intermittent write: connection timed out errors caused by silently dropped TCP connections being reused from the connection pool. See #10735.

Security Fixes

Upgrade Go builder from Go1.26.3 to Go1.26.4 addressing issues listed in https://github.com/golang/go/issues?q=milestone%3AGo1.26.4%20label%3ACherryPickApproved

View diff on GitHub

Weekly OSS security release digest.

The CVE patches and breaking changes that affected production tools this week. One email, every Sunday.

No spam, unsubscribe anytime.

Share this release

Share on X Share on Bluesky

Track VictoriaMetrics

Get notified when new releases ship.

About VictoriaMetrics

VictoriaMetrics: fast, cost-effective monitoring solution and time series database

All releases →