VictoriaMetrics/VictoriaMetrics v1.136.17

on GitHub

v1.136.17

Released at 2026-08-28

v1.136.x is a line of LTS releases. It contains important up-to-date bugfixes for VictoriaMetrics enterprise.
All these fixes are also included in the latest community release.
The v1.136.x line will be supported for at least 12 months since v1.136.0 release

• SECURITY: vmsingle, vmagent, vminsert and vmselect in VictoriaMetrics cluster: check HTTP Basic Auth credentials from the -httpAuth.* command-line flags for cases that do not verify the corresponding *AuthKey command-line flag on its own. Previously, HTTP Basic Auth could be skipped for request paths ending with suffixes such as /config, /reload. For example, /api/v1/import/prometheus/config was routed to the data ingestion handler /api/v1/import/prometheus without checking -httpAuth.* credentials.

• BUGFIX: vmagent and vminsert in VictoriaMetrics cluster: fix infinite loop in the OpenTelemetry Firehose ingestion endpoint (/opentelemetry/api/v1/push) when receiving a malformed record with an incomplete varint in the data field. Previously this caused the goroutine to spin forever, permanently consuming CPU until the process was restarted. See #11424.

• BUGFIX: vmsingle and vmselect in VictoriaMetrics cluster: prevent process crash in sort_by_label_numeric() and sort_by_label_numeric_desc() when a label value contains a number with 309 or more digits. See #11423.

• BUGFIX: vmsingle and vmstorage in VictoriaMetrics cluster: fixes rare metrics metadata partial search response. See #11384.

• BUGFIX: vmsingle and vmselect in VictoriaMetrics cluster: properly re-use memory if query aggregation returns error. See #11426.

• BUGFIX: vmselect in VictoriaMetrics cluster: fail the query request directly when there is not enough disk space to store temporary search results. Previously, such queries could lead to vmselect crash. See #4688.

• BUGFIX: vmselect in VictoriaMetrics cluster: consistently re-use memory during storage blocks unpacking on parsing storage block error. See #11421.

• BUGFIX: vmalert: fix parsing of instant query sample timestamps from Prometheus-compatible data sources. Previously, decimal (e.g. 1786458420.123) or scientific-notation (e.g. 1.78645842E9) values were silently truncated to 0. See #11396. Thanks to @missusk for the contribution.

• BUGFIX: vmctl: properly release the export and import requests during migration requests fails in vm-native mode. Previously, failed export/import requests could have left hanging at the source or the destination. The fix is supposed to improve the resiliency of vmctl during long-running migrations.

• BUGFIX: vmctl: reuse connections in vm-native mode when --vm-concurrency exceeds 2. Previously the number of idle connections was limited to 2 per host, which was insufficient when --vm-concurrency was bigger than 2. See #11451.

• BUGFIX: vmsingle, vminsert in VictoriaMetrics cluster and vmagent: fix process crash at /api/v1/import/native endpoint when receiving a specially crafted ~45-byte request. #11471.

• BUGFIX: vmsingle, vmagent and vmstorage in VictoriaMetrics cluster: allow access to /remotewrite-relabel-config, /api/v1/status/remotewrite-relabel-config, /remotewrite-url-relabel-config, /api/v1/status/remotewrite-url-relabel-config and /internal/log_new_series with only the corresponding -configAuthKey or -logNewSeriesAuthKey, even when -httpAuth.* is also configured, without additionally requiring -httpAuth.* credentials. See bedc69014.