VictoriaMetrics v1.148.3

Released at 2026-08-28

v1.148.x is a line of LTS releases. It contains important up-to-date bugfixes for VictoriaMetrics enterprise. All these fixes are also included in the latest community release. The v1.148.x line will be supported for at least 12 months since v1.148.0 release

• SECURITY: vmsingle, vmagent, vminsert and vmselect in VictoriaMetrics cluster: check HTTP Basic Auth credentials from the -httpAuth.* command-line flags for cases that do not verify the corresponding *AuthKey command-line flag on its own. Previously, HTTP Basic Auth could be skipped for request paths ending with suffixes such as /config, /reload. For example, /api/v1/import/prometheus/config was routed to the data ingestion handler /api/v1/import/prometheus without checking -httpAuth.* credentials.

• BUGFIX: vmagent and vminsert in VictoriaMetrics cluster: fix infinite loop in the OpenTelemetry Firehose ingestion endpoint (/opentelemetry/api/v1/push) when receiving a malformed record with an incomplete varint in the data field. Previously this caused the goroutine to spin forever, permanently consuming CPU until the process was restarted. See #11424.

• BUGFIX: vmsingle and vmselect in VictoriaMetrics cluster: prevent process crash in sort_by_label_numeric() and sort_by_label_numeric_desc() when a label value contains a number with 309 or more digits. See #11423.

• BUGFIX: vmsingle and vmstorage in VictoriaMetrics cluster: fixes rare metrics metadata partial search response. See #11384.

• BUGFIX: vmsingle and vmselect in VictoriaMetrics cluster: properly re-use memory if query aggregation returns error. See #11426.

• BUGFIX: vmselect in VictoriaMetrics cluster: fail the query request directly when there is not enough disk space to store temporary search results. Previously, such queries could lead to vmselect crash. See #4688.

• BUGFIX: vmselect in VictoriaMetrics cluster: consistently re-use memory during storage blocks unpacking on parsing storage block error. See #11421.

• BUGFIX: vmalert: fix parsing of instant query sample timestamps from Prometheus-compatible data sources. Previously, decimal (e.g. 1786458420.123) or scientific-notation (e.g. 1.78645842E9) values were silently truncated to 0. See #11396. Thanks to @missusk for the contribution.

• BUGFIX: vmctl: properly release the export and import requests during migration requests fails in vm-native mode. Previously, failed export/import requests could have left hanging at the source or the destination. The fix is supposed to improve the resiliency of vmctl during long-running migrations.

• BUGFIX: vmctl: reuse connections in vm-native mode when --vm-concurrency exceeds 2. Previously the number of idle connections was limited to 2 per host, which was insufficient when --vm-concurrency was bigger than 2. See #11451.

• BUGFIX: vmagent: include vm_account_id and vm_project_id labels in the instance identity used by monitoring data exchange filtering. Previously, when multitenant handlers were enabled, series from different tenants sharing the same job and instance labels could be misidentified as coming from a discovered VictoriaMetrics instance and leak into the -remoteWrite.mdx.enable destination. See #11381.

• BUGFIX: vmsingle, vminsert in VictoriaMetrics cluster and vmagent: fix process crash at /api/v1/import/native endpoint when receiving a specially crafted ~45-byte request. #11471.

• BUGFIX: vmsingle, vmagent and vmstorage in VictoriaMetrics cluster: allow access to /remotewrite-relabel-config, /api/v1/status/remotewrite-relabel-config, /remotewrite-url-relabel-config, /api/v1/status/remotewrite-url-relabel-config and /internal/log_new_series with only the corresponding -configAuthKey or -logNewSeriesAuthKey, even when -httpAuth.* is also configured, without additionally requiring -httpAuth.* credentials. See bedc69014.