Releases — RATATOSK

Cortexv1.21.1ObservabilityJun 5, 2026

A maintenance release with operator-facing security fixes and configuration changes across ingestion, distribution, and status pages. It also includes fixes for request handling, authentication, configuration exposure, gossip limits, and client and runtime panics.

Check if affected (3)

securityStored XSS protection in Alertmanager and Store Gateway status pages
Applies if you run Alertmanager or Store Gateway.
Alertmanager and Store Gateway status pages now use html/template instead of text/template, fixing the stored XSS vulnerability.
securityWrappedHistogram native histogram size limit
Applies if you use native histograms.
The Distributor adds WrappedHistogram with a configurable size limit, controlled by -validation.max-native-histogram-size-bytes and set to 16 KB by default. The limit caps native histogram protobuf data before unmarshalling and addresses memory amplification attacks via packed varint deltas.
breakingDecompressed gzip output limit for ParseProtoReader and OTLP ingestion
Applies if you use the OTLP ingestion path.
The decompressed body in ParseProtoReader and the OTLP ingestion path is capped by -distributor.otlp-max-recv-msg-size.

Source ↗