Skip to content

fix: harden Buffer collection and stripe indexing#2289

Open
arnabnandy7 wants to merge 3 commits into
prometheus:mainfrom
arnabnandy7:security/prometheus-buffer-fix
Open

fix: harden Buffer collection and stripe indexing#2289
arnabnandy7 wants to merge 3 commits into
prometheus:mainfrom
arnabnandy7:security/prometheus-buffer-fix

Conversation

@arnabnandy7

@arnabnandy7 arnabnandy7 commented Jul 8, 2026

Copy link
Copy Markdown
Contributor

Summary

Fixes #2287 and #2282 in prometheus-metrics-core’s Buffer.

Changes

  • Bound the Buffer.run() spin wait during collection so the buffer cannot stay active indefinitely while waiting for in-flight observations.
  • On timeout, deactivate the buffer, replay already buffered observations, then throw an IllegalStateException.
  • Preserve existing side-effect-only Buffer.run() callers that intentionally return null.
  • Replace the stripe index calculation with Math.floorMod(threadId, stripeCount) to avoid Math.abs(Integer.MIN_VALUE) overflow.
  • Add regression tests for both timeout cleanup behavior and the Integer.MIN_VALUE thread-id narrowing case.

Validation

  • mise run lint:fix
  • .\mvnw test -pl prometheus-metrics-core '-Dtest=BufferTest' '-Dcoverage.skip=true' '-Dcheckstyle.skip=true'
  • .\mvnw test -pl prometheus-metrics-core '-Dtest=HistogramTest#testGolangTests,BufferTest' '-Dcoverage.skip=true' '-Dcheckstyle.skip=true'
  • .\mvnw install -pl prometheus-metrics-core -am -DskipTests '-Dcoverage.skip=true'
  • git diff --check

Note: mise run build does not run directly in this Windows shell because the task invokes Unix-style ./mvnw; the equivalent Maven wrapper commands above passed.

Signed-off-by: Arnab Nandy <arnab_nandy7@yahoo.com>
Signed-off-by: Arnab Nandy <arnab_nandy7@yahoo.com>
Signed-off-by: Arnab Nandy <arnab_nandy7@yahoo.com>
@arnabnandy7 arnabnandy7 changed the title fix: bound buffer spin wait during collection #2287 fix: harden Buffer collection and stripe indexing Jul 8, 2026
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

# Security Report: Unbounded Observation Buffer Growth During Stalled Scrape in prometheus/client_java

1 participant