Skip to content

VictoriaMetrics

v1.136.11 Security

This release includes 1 security fix for security teams reviewing exposed deployments.

Published 1mo Monitoring & Metrics
✓ No known CVEs patched
Read the diff → Tool health → What is this tool? →
This release patches 1 known CVE

Topics

database grafana graphite influxdb kubernetes monitoring
+7 more
observability opentelemetry opentsdb prometheus promql thanos tsdb

Affected surfaces

deps

ReleasePort's take

Moderate signal
editorial:auto 1mo

Upgrade the Go builder from version 1.26.3 to 1.26.4 as part of this release.

Why it matters: Severity 90 security fix; upgrade required for all build environments using Go 1.26.3.

Summary

AI summary

Updates BUGFIX, https://docs.victoriametrics.com/victoriametrics/cluster-victoriametrics/, and https://docs.victoriametrics.com/victoriametrics/vmalert/ across a mixed release.

Changes in this release

Security Critical

Upgrade Go builder from Go1.26.3 to Go1.26.4.

Upgrade Go builder from Go1.26.3 to Go1.26.4.

Source: llm_adapter@2026-06-08

Confidence: high

Bugfix Medium

`integrate()` no longer extrapolates the last sample's value past series end.

`integrate()` no longer extrapolates the last sample's value past series end.

Source: llm_adapter@2026-06-08

Confidence: high

Bugfix Medium

Persist `Disable deduplication` toggle state in vmui across reloads.

Persist `Disable deduplication` toggle state in vmui across reloads.

Source: llm_adapter@2026-06-08

Confidence: high

Bugfix Medium

Fix vmalert `Notifiers` page appearing blank despite API returning data.

Fix vmalert `Notifiers` page appearing blank despite API returning data.

Source: llm_adapter@2026-06-08

Confidence: high

Bugfix Medium

Reset vmalert group evaluation timestamp if it exceeds current host time.

Reset vmalert group evaluation timestamp if it exceeds current host time.

Source: llm_adapter@2026-06-08

Confidence: high

Bugfix Medium

Avoid HTTP 503 for queries with partial results when a storage group is unavailable if `-search.denyPartialResponse` is disabled.

Avoid HTTP 503 for queries with partial results when a storage group is unavailable if `-search.denyPartialResponse` is disabled.

Source: llm_adapter@2026-06-08

Confidence: high

Bugfix Medium

Properly escape UTF‑8 label names for `/federate` API requests in vmsingle and vmselect.

Properly escape UTF‑8 label names for `/federate` API requests in vmsingle and vmselect.

Source: llm_adapter@2026-06-08

Confidence: high

Bugfix Medium

Fix intermittent `write: connection timed out` errors in vmselect caused by reused dropped TCP connections.

Fix intermittent `write: connection timed out` errors in vmselect caused by reused dropped TCP connections.

Source: llm_adapter@2026-06-08

Confidence: high

Full changelog

v1.136.11

Released at 2026-06-05

v1.136.x is a line of LTS releases. It contains important up-to-date bugfixes for VictoriaMetrics enterprise.
All these fixes are also included in the latest community release.
The v1.136.x line will be supported for at least 12 months since v1.136.0 release

  • SECURITY: upgrade Go builder from Go1.26.3 to Go1.26.4. See the list of issues addressed in Go1.26.4.

  • BUGFIX: MetricsQL: integrate() no longer extrapolates the last sample's value past the end of the time series. Previously, querying integrate(metric[1h]) at a timestamp where the series had already ended would keep accruing area as if the last value continued indefinitely, producing values much larger than the true integral. See #9474. Thanks to @wtfashwin for contribution.

  • BUGFIX: vmui: persist the Disable deduplication toggle under its own local storage key. Before this fix, the toggle state was lost after reload and could overwrite the Compact view table setting. See #11004. Thanks to @immanuwell for the contribution.

  • BUGFIX: vmalert: fix the Notifiers page in web UI appearing blank despite the API returning notifier data correctly. See #11035.

  • BUGFIX: vmalert: reset the group evaluation timestamp if it exceeds the current host time. Previously, vmalert could use future timestamps for evaluations if the system clock was shifted backward. See #10985.

  • BUGFIX: vmselect in VictoriaMetrics cluster: avoid returning HTTP 503 for queries with partial results when a storage group is unavailable and -search.denyPartialResponse is disabled. See #11009. Thanks to @fxrlv for the contribution.

  • BUGFIX: vmsingle and vmselect in VictoriaMetrics cluster: properly escape utf-8 label names for /federate API requests. See #10968.

  • BUGFIX: vmselect in VictoriaMetrics cluster: fix intermittent write: connection timed out errors caused by silently dropped TCP connections being reused from the connection pool. See #10735.

Security Fixes

  • Upgrade Go builder from Go1.26.3 to Go1.26.4 (addresses issues in Go1.26.4)

Weekly OSS security release digest.

The CVE patches and breaking changes that affected production tools this week. One email, every Sunday.

No spam, unsubscribe anytime.

Share this release

Track VictoriaMetrics

Get notified when new releases ship.

Sign up free

About VictoriaMetrics

VictoriaMetrics: fast, cost-effective monitoring solution and time series database

All releases →

Related context

Beta — feedback welcome: [email protected]