# VictoriaMetrics v1.148.3

- Product: VictoriaMetrics (https://whatsnew.fyi/product/victoriametrics)
- Vendor: VictoriaMetrics
- Date: 2026-08-31
- Version: v1.148.3
- Original notes: https://github.com/VictoriaMetrics/VictoriaMetrics/releases/tag/v1.148.3
- Permalink: https://whatsnew.fyi/product/victoriametrics/releases/v1.148.3

What's New is an index, not a publisher: every entry below links to the vendor's own release notes, which are the authoritative source. Entries are labelled where they are hand-curated sample data, pre-releases, or drawn from a secondary source such as a developer blog.

Reuse: the summaries, labels and curation here are © What's New. Quote freely with attribution and a link back; wholesale republication of the corpus is not permitted — terms: https://whatsnew.fyi/terms. The vendors' own release notes remain their publishers'.

---

- **security** — Check HTTP Basic Auth credentials from `-httpAuth.*` command-line flags for all request paths, including those ending with suffixes like `/config` and `/reload`, to prevent authentication bypass
- **fixed** — Fix infinite loop in the OpenTelemetry Firehose ingestion endpoint (`/opentelemetry/api/v1/push`) when receiving a malformed record with an incomplete varint in the data field
- **fixed** — Prevent process crash in `sort_by_label_numeric()` and `sort_by_label_numeric_desc()` when a label value contains a number with 309 or more digits
- **fixed** — Fix rare metrics metadata partial search response in vmsingle and vmstorage
- **fixed** — Properly re-use memory if query aggregation returns error
- **fixed** — Fail the query request directly when there is not enough disk space to store temporary search results instead of causing vmselect crash
- **fixed** — Consistently re-use memory during storage blocks unpacking on parsing storage block error
- **fixed** — Fix parsing of instant query sample timestamps from Prometheus-compatible data sources to handle decimal and scientific-notation values
- **fixed** — Properly release export and import requests during migration failures in vmctl vm-native mode
- **fixed** — Reuse connections in vmctl vm-native mode when `--vm-concurrency` exceeds 2
- **fixed** — Include `vm_account_id` and `vm_project_id` labels in the instance identity used by monitoring data exchange filtering to prevent series leakage between tenants

##### [v1.148.3](https://github.com/VictoriaMetrics/VictoriaMetrics/releases/tag/v1.148.3)

Released at 2026-08-28

**v1.148.x is a line of [LTS releases](https://docs.victoriametrics.com/victoriametrics/lts-releases/). It contains important up-to-date bugfixes for [VictoriaMetrics enterprise](https://docs.victoriametrics.com/victoriametrics/enterprise/).
All these fixes are also included in [the latest community release](https://github.com/VictoriaMetrics/VictoriaMetrics/releases/latest).
The v1.148.x line will be supported for at least 12 months since [v1.148.0](https://docs.victoriametrics.com/victoriametrics/changelog/#v11480) release**

* SECURITY: [vmsingle](https://docs.victoriametrics.com/victoriametrics/single-server-victoriametrics/), [vmagent](https://docs.victoriametrics.com/victoriametrics/vmagent/), `vminsert` and `vmselect` in [VictoriaMetrics cluster](https://docs.victoriametrics.com/victoriametrics/cluster-victoriametrics/): check HTTP Basic Auth credentials from the `-httpAuth.*` command-line flags for cases that do not verify the corresponding `*AuthKey` command-line flag on its own. Previously, HTTP Basic Auth could be skipped for request paths ending with suffixes such as `/config`, `/reload`. For example, `/api/v1/import/prometheus/config` was routed to the data ingestion handler `/api/v1/import/prometheus` without checking `-httpAuth.*` credentials.

* BUGFIX: [vmagent](https://docs.victoriametrics.com/victoriametrics/vmagent/) and `vminsert` in [VictoriaMetrics cluster](https://docs.victoriametrics.com/victoriametrics/cluster-victoriametrics/): fix infinite loop in the OpenTelemetry Firehose ingestion endpoint (`/opentelemetry/api/v1/push`) when receiving a malformed record with an incomplete varint in the `data` field. Previously this caused the goroutine to spin forever, permanently consuming CPU until the process was restarted. See [#11424](https://github.com/VictoriaMetrics/VictoriaMetrics/pull/11424).
* BUGFIX: [vmsingle](https://docs.victoriametrics.com/victoriametrics/single-server-victoriametrics/) and `vmselect` in [VictoriaMetrics cluster](https://docs.victoriametrics.com/victoriametrics/cluster-victoriametrics/): prevent process crash in `sort_by_label_numeric()` and `sort_by_label_numeric_desc()` when a label value contains a number with 309 or more digits. See [#11423](https://github.com/VictoriaMetrics/VictoriaMetrics/pull/11423).
* BUGFIX: [vmsingle](https://docs.victoriametrics.com/victoriametrics/single-server-victoriametrics/) and `vmstorage` in [VictoriaMetrics cluster](https://docs.victoriametrics.com/victoriametrics/cluster-victoriametrics/): fixes rare metrics metadata partial search response. See [#11384](https://github.com/VictoriaMetrics/VictoriaMetrics/issues/11384).
* BUGFIX: [vmsingle](https://docs.victoriametrics.com/victoriametrics/single-server-victoriametrics/) and `vmselect` in [VictoriaMetrics cluster](https://docs.victoriametrics.com/victoriametrics/cluster-victoriametrics/): properly re-use memory if query aggregation returns error. See [#11426](https://github.com/VictoriaMetrics/VictoriaMetrics/pull/11426).
* BUGFIX: `vmselect` in [VictoriaMetrics cluster](https://docs.victoriametrics.com/victoriametrics/cluster-victoriametrics/): fail the query request directly when there is not enough disk space to store temporary search results. Previously, such queries could lead to vmselect crash. See [#4688](https://github.com/VictoriaMetrics/VictoriaMetrics/issues/4688).
* BUGFIX: `vmselect` in [VictoriaMetrics cluster](https://docs.victoriametrics.com/victoriametrics/cluster-victoriametrics/): consistently re-use memory during storage blocks unpacking on parsing storage block error. See [#11421](https://github.com/VictoriaMetrics/VictoriaMetrics/pull/11421).
* BUGFIX: [vmalert](https://docs.victoriametrics.com/victoriametrics/vmalert/): fix parsing of instant query sample timestamps from Prometheus-compatible data sources. Previously, decimal (e.g. `1786458420.123`) or scient

_[Truncated at 4000 characters — full notes: https://github.com/VictoriaMetrics/VictoriaMetrics/releases/tag/v1.148.3]_