# Prometheus v3.15.1

> Observability · 2026-10-21

A security maintenance release updates the Go toolchain and network dependency while removing compromised root trust from container images. It addresses vulnerabilities in the shipped build and networking components and changes which certificate authorities those images trust.

## Action needed
- **[security · critical]** `golang.org/x/net` at `v0.60.0`
  - The release updates `golang.org/x/net` to `v0.60.0` to address HTTP/2 vulnerabilities identified by `GO-2026-6603`, `GO-2026-6610`, `GO-2026-6611`, `GO-2026-6612`, and `GO-2026-6617`.
- **[security]** Container image trust in `emSign ECC Root CA - G3` and `Comodo AAA Services root`
  - Container images now distrust `emSign ECC Root CA - G3` and `Comodo AAA Services root` after the compromise of eMudhra intermediate CA private keys.
- **[security]** Builds with `Go 1.27.3`
  - The release builds with `Go 1.27.3` to address vulnerabilities in `net/http`, `net/textproto`, `crypto/tls`, and `html/template`.

[Full analysis](https://ratatosk.io/en/releases/prometheus/v3.15.1)

[Original release notes](https://github.com/prometheus/prometheus/releases/tag/v3.15.1)