Skip to main content
No exploitation reportedFix available

CVE-2022-21698

No exploitation reported by the sources we read.

  • Published2022-02-15
  • WeaknessCWE-400 · CWE-770

Am I affected?

With a domain, we read the version its public headers and pages expose. A distribution build can carry the fix under an older number.

Description

client_golang is the instrumentation library for Go applications in Prometheus, and the promhttp package in client_golang provides tooling around HTTP servers and clients. In client_golang prior to version 1.11.1, HTTP server is susceptible to a Denial of Service through unbounded cardinality, and potential memory exhaustion, when handling requests with non-standard HTTP methods. In order to be affected, an instrumented software must use any of `promhttp.InstrumentHandler*` middleware except `RequestsInFlight`; not filter any specific methods (e.g GET) before middleware; pass metric with `method` label name to our middleware; and not have any firewall/LB/proxy that filters away requests with unknown `method`. client_golang version 1.11.1 contains a patch for this issue. Several workarounds are available, including removing the `method` label name from counter/gauge used in the InstrumentHandler; turning off affected promhttp handlers; adding custom middleware before promhttp handler that will sanitize the request method given by Go http.Request; and using a reverse proxy or web application firewall, configured to only allow a limited set of methods.

Timeline

dates in UTC
  1. 2022-02-1516:15CVE publishedNVD

Observed activity

isMalicious corpus · updated 2026-10-23 21:37 UTC
Indicators tagged with this CVE, per day0 indicators over 7 days
Block these indicators
  • Firewall list (EDL, text): https://api.ismalicious.com/edl/cve/CVE-2022-21698?format=txt
  • CSV export: https://api.ismalicious.com/edl/cve/CVE-2022-21698?format=csv
  • TAXII collection of exploited CVEs
  • The EDL and CSV take an API key on the Pro plan.

Versions per branch

NVD · OSV
Fedoraproject fedora
BranchAffectedFixed in
34.x= 34no fix published
35.x= 35no fix published
36.x= 36no fix published
37.x= 37no fix published
Fedoraproject extra packages for enterprise linux
BranchAffectedFixed in
7.0= 7.0no fix published
8.0= 8.0no fix published
Prometheus client golang
BranchAffectedFixed in
1.11< 1.11.11.11.1

1 more product in the sources.

as publishedRanges as NVD and OSV publish them; a distribution’s build can be fixed under an older number.

Distribution builds and vendor advisories

Packages from OSV.dev and products from the vendors' CSAF advisories.

version not verifiedVersions not verified: read as OSV.dev and the vendors publish them, not checked against each vendor's release list.

Packages

  • buildahAlmaLinux:8all versions · fixed in 1.19.9-6.module_el8.7.0+3297+1eb250cfand 1 other package
  • buildahAlmaLinux:8all versions · fixed in 1:1.24.2-4.module_el8.6.0+2878+e681bc44and 1 other package
  • cockpit-podmanAlmaLinux:8all versions · fixed in 29-2.module_el8.6.0+2876+9ed4eae2
  • cockpit-podmanAlmaLinux:8all versions · fixed in 43-1.module_el8.6.0+2877+8e437bf5
  • conmonAlmaLinux:8all versions · fixed in 2:2.0.26-3.module_el8.7.0+3297+1eb250cf
  • conmonAlmaLinux:8all versions · fixed in 2:2.1.0-1.module_el8.6.0+2877+8e437bf5
  • container-selinuxAlmaLinux:8all versions · fixed in 2:2.179.1-1.module_el8.6.0+2878+e681bc44
  • container-selinuxAlmaLinux:8all versions · fixed in 2:2.189.0-1.module_el8.6.0+3336+00d107d5

41 more package ranges on OSV.dev

Vendor advisories

  • RHSA-2026:0722 Red Hat Product Security4 products fixed

    Red Hat Security Advisory: multicluster engine for Kubernetes v2.8.4 security update

  • RHSA-2025:23528 Red Hat Product Security4 products fixed

    Red Hat Security Advisory: multicluster engine for Kubernetes 2.6 security update

  • RHSA-2025:22684 Red Hat Product Security8 products fixed

    Red Hat Security Advisory: Red Hat Advanced Cluster Management for Kubernetes 2.12.6 security update

  • RHSA-2025:22683 Red Hat Product Security4 products fixed

    Red Hat Security Advisory: multicluster engine for Kubernetes v2.7.7 security update

  • RHSA-2024:4631 Red Hat Product Security6 products fixed

    Red Hat Security Advisory: Red Hat OpenShift Dev Spaces 3.15.0 release

  • RHSA-2024:2944 Red Hat Product Security5 products fixed

    Red Hat Security Advisory: AMQ Broker 7.12.0.OPR.1.GA Container Images release and security update

37 more advisories

Full record on NVD

Fix

  1. Vendor fix Red Hat Product Security RHSA-2026:0722 · 4 productsFor multicluster engine for Kubernetes, see the following documentation for details on how to install the images: https://access.redhat.com/documentation/en-us/red_hat_advanced_cluster_management_for_kubernetes/2.13/html/clusters/cluster_mce_overview#mce-install-intro
  2. Vendor fix Red Hat Product Security RHSA-2025:23528 · 4 productsFor multicluster engine for Kubernetes, see the following documentation for details on how to install the images: https://access.redhat.com/documentation/en-us/red_hat_advanced_cluster_management_for_kubernetes/2.11/html/clusters/cluster_mce_overview#mce-install-intro
  3. Vendor fix Red Hat Product Security RHSA-2025:22684 · 8 productsBefore you apply this update, make sure all previously released errata that are relevant to your system are applied. For details on how to apply this update, refer to: https://access.redhat.com/articles/11258
  4. Vendor fix Red Hat Product Security RHSA-2025:22683 · 4 productsFor multicluster engine for Kubernetes, see the following documentation for details on how to install the images: https://access.redhat.com/documentation/en-us/red_hat_advanced_cluster_management_for_kubernetes/2.12/html/clusters/cluster_mce_overview#mce-install-intro
  5. Vendor fix Red Hat Product Security RHSA-2024:4631 · 6 productsBefore applying this update, make sure all previously released errata relevant to your system have been applied. For details on how to apply this update, refer to: https://access.redhat.com/articles/11258
  6. Vendor fix Red Hat Product Security RHSA-2024:2944 · 5 productsTo update to the latest image please refer to the AMQ container images in the Red Hat Container catalog.

Advisories and patches

Detection

Nuclei template
none so far
ProjectDiscovery
Exploit-DB
no entry
Exploit-DB
Proof-of-concept repositories
none listed
PoC-in-GitHub

Sources

  • CISA-ADPSSVC decisionnone2025-04-23
  • OpenCVESSVC decisionnone—
  • CNACVSS 3.17.5read 2026-10-23
  • NVDCVSS 3.17.5read 2026-10-23
  • NVDCVSS 2.05read 2026-10-23
  • CNAweakness (CWE)CWE-400read 2026-10-23
  • NVDweakness (CWE)CWE-770read 2026-10-23
  • FIRST EPSSEPSS score6.0 %2026-10-23
  • OSVaffected packages—

Technical details

CVSS v3 Vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Published
2022-02-15
Last Modified
2026-06-17
NVD status
Modified

Frequently asked questions

What is CVE-2022-21698?

client_golang is the instrumentation library for Go applications in Prometheus, and the promhttp package in client_golang provides tooling around HTTP servers and clients. In client_golang prior to version 1.11.1, HTTP server is susceptible to a Denial of Service through unbounded cardinality, and potential memory exhaustion, when handling requests with non-standard HTTP methods. In order to be affected, an instrumented software must use any of `promhttp.InstrumentHandler*` middleware except `RequestsInFlight`; not filter any specific methods (e.g GET) before middleware; pass metric with `method` label name to our middleware; and not have any firewall/LB/proxy that filters away requests with unknown `method`. client_golang version 1.11.1 contains a patch for this issue. Several workarounds are available, including removing the `method` label name from counter/gauge used in the InstrumentHandler; turning off affected promhttp handlers; adding custom middleware before promhttp handler that will sanitize the request method given by Go http.Request; and using a reverse proxy or web application firewall, configured to only allow a limited set of methods.

Is CVE-2022-21698 actively exploited?

Active exploitation of CVE-2022-21698 has not been confirmed. Its EPSS score was 6.0% on 2026-10-23, the estimated probability of exploitation in the next 30 days.

What is the CVSS score for CVE-2022-21698?

CVE-2022-21698 has a CVSS v3 base score of 7.5 (HIGH severity), with vector string CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H.

Running prometheus/client_golang? Hear about its next vulnerability

Surveillance reads the versions in your stack — a domain, a lockfile or a list — checks each CVE against the ranges its sources publish, and alerts you when one you run is exploited or enters CISA KEV. A version it cannot read stays « version not verified ».

Get alerts for this productCISA KEV additions, October 2026Search CVEs

No credit card required · No monthly cap on website lookups · 250 API requests/month

Go further

Related vulnerabilities

Same product first, then the same vendor advisory and the same publication week.

Back to CVE Database