VictoriaMetrics

v1.136.9 Security

This release includes 1 security fix for security teams reviewing exposed deployments.

Published 23d Monitoring & Metrics

View tool

✓ No known CVEs patched

Read the diff → Tool health → What is this tool? →

This release patches 1 known CVE

Topics

database grafana graphite influxdb kubernetes monitoring

+7 more

observability opentelemetry opentsdb prometheus promql thanos tsdb

ReleasePort's take

Light signal

editorial:auto 13d

The Go builder was upgraded from version 1.26.2 to 1.26.3, addressing security issues in the build environment.

Why it matters: Patch the Go builder to 1.26.3 immediately if you use it for builds; this upgrade resolves identified security vulnerabilities.

Summary

AI summary

Upgrade Go builder from 1.26.2 to 1.26.3, fixing security issues in the build environment.

Changes in this release

Type	Severity	Summary	CVE
Security	Medium	Go builder upgraded from Go1.26.2 to Go1.26.3 Go builder upgraded from Go1.26.2 to Go1.26.3 Source: llm_adapter@2026-05-21 Confidence: low	—
Bugfix
Bugfix	Medium	vmbackupmanager explicitly sets MD5 checksum for DeleteObjects requests vmbackupmanager explicitly sets MD5 checksum for DeleteObjects requests Source: llm_adapter@2026-05-21 Confidence: high	—
Bugfix	Medium	vmsingle and vmselect prioritize URL query extra_label over request body vmsingle and vmselect prioritize URL query extra_label over request body Source: llm_adapter@2026-05-21 Confidence: high	—
Bugfix	Medium	vmagent and vmsingle correctly obtain Hetzner location labels vmagent and vmsingle correctly obtain Hetzner location labels Source: llm_adapter@2026-05-21 Confidence: high	—
Bugfix	Medium	vmauth attempts first backend when all backends marked broken vmauth attempts first backend when all backends marked broken Source: llm_adapter@2026-05-21 Confidence: high	—
Bugfix	Medium	vmauth correctly respects disabling retries via -maxRequestBodySizeToRetry=0 vmauth correctly respects disabling retries via -maxRequestBodySizeToRetry=0 Source: llm_adapter@2026-05-21 Confidence: high	—
Bugfix	Medium	vmsingle and vmselect set CORS headers on export endpoints vmsingle and vmselect set CORS headers on export endpoints Source: llm_adapter@2026-05-21 Confidence: low	—

Full changelog

v1.136.9

Released at 2026-05-08

v1.136.x is a line of LTS releases. It contains important up-to-date bugfixes for VictoriaMetrics enterprise.
All these fixes are also included in the latest community release.
The v1.136.x line will be supported for at least 12 months since v1.136.0 release

SECURITY: upgrade Go builder from Go1.26.2 to Go1.26.3. See the list of issues addressed in Go1.26.3.
BUGFIX: vmagent and vmsingle: properly obtain __meta_hetzner_hcloud_location and __meta_hetzner_hcloud_location_network_zone labels for hetzner_sd_configs. Hetzner changed discovery API response and returns location information from different field. See #10909. Thanks to @juliusrickert for contribution.
BUGFIX: vmauth: now correctly respects disabling retries via -maxRequestBodySizeToRetry=0. Previously, disabling retries required setting both -maxRequestBodySizeToRetry and -requestBufferSize to 0. See #10857. Thanks to @andriibeee for the contribution.
BUGFIX: vmbackupmanager: explicitly set the MD5 checksum for DeleteObjects requests. Starting with aws-sdk-go-v2/service/s3 v1.73.0, the SDK switched the checksum algorithm from MD5 to CRC32, which can break compatibility with some third-party S3 implementations, including Dell ECS. See #10907.
BUGFIX: vmauth: attempt to route requests to the first backend when all backends are marked as broken. Previously, vmauth returned an error immediately without attempting any backend. This change may improve success rate in rare edge cases. See #10837.
BUGFIX: vmsingle: and vmselect in VictoriaMetrics cluster: give priority to extra_label and extra_filters[] params defined in URL query string over those defined in request body form, to properly respect constraints imposed by vmauth. See #10908.
BUGFIX: vmsingle and vmselect in VictoriaMetrics cluster: set CORS headers on /api/v1/export, /api/v1/export/csv and /api/v1/export/native. See #10899. Thanks to @andriibeee for the contribution.

Security Fixes

Upgrade Go builder to version 1.26.3, addressing security issues listed in the Go 1.26.3 changelog.

View diff on GitHub

Weekly OSS security release digest.

The CVE patches and breaking changes that affected production tools this week. One email, every Sunday.

No spam, unsubscribe anytime.

Share this release

Share on X Share on Bluesky

Track VictoriaMetrics

Get notified when new releases ship.

About VictoriaMetrics

VictoriaMetrics: fast, cost-effective monitoring solution and time series database

All releases →