Skip to content

VictoriaMetrics

v1.136.13 Security

This release includes 1 security fix for security teams reviewing exposed deployments.

Published 20d Monitoring & Metrics
✓ No known CVEs patched
Read the diff → Tool health → What is this tool? →
This release patches 1 known CVE

Topics

database grafana graphite influxdb kubernetes monitoring
+7 more
observability opentelemetry opentsdb prometheus promql thanos tsdb

Affected surfaces

deps

Summary

AI summary

Updates BUGFIX, https://docs.victoriametrics.com/victoriametrics/cluster-victoriametrics/, and https://github.com/VictoriaMetrics/VictoriaMetrics/releases/latest across a mixed release.

Full changelog

v1.136.13

Released at 2026-07-03

v1.136.x is a line of LTS releases. It contains important up-to-date bugfixes for VictoriaMetrics enterprise.
All these fixes are also included in the latest community release.
The v1.136.x line will be supported for at least 12 months since v1.136.0 release

  • SECURITY: upgrade base docker image (Alpine) from 3.23.4 to 3.24.1. See Alpine 3.24.1 release notes.

  • BUGFIX: vminsert in VictoriaMetrics cluster and vmsingle: properly check values range for the limits configured with flags -maxLabelsPerTimeseries, -maxLabelNameLen and -maxLabelValueLen. It must be in range 1..65535. See #11128.

  • BUGFIX: vminsert in VictoriaMetrics cluster: fixes unexpected rare rerouting. See #11162.

  • BUGFIX: vmselect in VictoriaMetrics cluster: propagate cache reset operation to selectNode when /internal/resetRollupResultCache is called. Previously, the propagation only happened when the delete_series API was called. See #11112.

  • BUGFIX: stream aggregation: fix possible unexpected increases in rate_avg and rate_sum if an out-of-order sample is ingested after the previous flush. See #11140.

  • BUGFIX: vmctl: properly URL-encode -vm-extra-label values when building import requests, so special characters such as & don't get split into broken query parameters. See #11144. Thanks to @immanuwell for contribution.

  • BUGFIX: enterprise vmagent: ignore enable.auto.offset.store option in kafka.consumer.topic.options, since vmagent manages offset storage internally. Previously, setting this option could cause vmagent to stop committing Kafka messages. See #11208.

  • BUGFIX: all VictoriaMetrics components: cancel in-flight HTTP requests shortly before -http.maxGracefulShutdownDuration elapses during graceful shutdown, so they can drain and the shutdown completes cleanly within that window instead of timing out and exiting via logger.Fatalf -> os.Exit. This prevents skipping the storage flush and losing in-memory data when long-lived requests are in flight (such as VictoriaLogs live tailing). See #1502.

Security Fixes

  • SECURITY: upgrade base docker image (Alpine) from 3.23.4 to 3.24.1

Weekly OSS security release digest.

The CVE patches and breaking changes that affected production tools this week. One email, every Sunday.

No spam, unsubscribe anytime.

Share this release

Track VictoriaMetrics

Get notified when new releases ship.

Sign up free

About VictoriaMetrics

VictoriaMetrics: fast, cost-effective monitoring solution and time series database

All releases →

Related context

Beta — feedback welcome: [email protected]