thanos
Technical details about the ’thanos’ component.
Generated on: 2026-10-23
Software Bill of Materials
Dependencies (Image)
| Dependency | Version | License | Vulnerabilities | Severity | Status |
|---|---|---|---|---|---|
| google.golang.org/grpc | v1.57.2 | Unknown | CVE-2026-33186 (google.golang.org/grpc/grpc-go: google.golang.org/grpc/authz: gRPC-Go: Authorization bypass due to improper HTTP/2 path validation) | CRITICAL | fixed (in 1.79.3) |
| github.com/golang-jwt/jwt/v5 | v5.2.0 | Unknown | CVE-2025-30204 (golang-jwt/jwt: jwt-go allows excessive memory allocation during header parsing) | HIGH | fixed (in 5.2.2) |
| github.com/klauspost/compress | v1.17.7 | Unknown | CVE-2026-63209 (github.com/klauspost/compress: klauspost/compress: Denial of Service via integer overflow in dictionary processing) | HIGH | fixed (in 1.18.7) |
| github.com/prometheus/prometheus | v0.51.1-0.20240325140356-78c0fd2f4d75 | Unknown | CVE-2026-42151 (github.com/prometheus/prometheus: Prometheus: Information disclosure of Azure OAuth client secret via config API) | HIGH | fixed (in 0.311.3) |
| go.opentelemetry.io/otel/sdk | v1.24.0 | Unknown | CVE-2026-24051 (opentelemetry-go: OpenTelemetry-Go Affected by Arbitrary Code Execution via PATH Hijacking) | HIGH | fixed (in 1.40.0) |
| golang.org/x/crypto | v0.21.0 | Unknown | CVE-2024-45337 (golang.org/x/crypto/ssh: Misuse of ServerConfig.PublicKeyCallback may cause authorization bypass in golang.org/x/crypto) | HIGH | fixed (in 0.31.0) |
| golang.org/x/net | v0.22.0 | Unknown | CVE-2023-45288 (golang: net/http, x/net/http2: unlimited number of CONTINUATION frames causes DoS) | HIGH | fixed (in 0.23.0) |
| golang.org/x/oauth2 | v0.18.0 | Unknown | CVE-2025-22868 (golang.org/x/oauth2/jws: Unexpected memory consumption during token parsing in golang.org/x/oauth2/jws) | HIGH | fixed (in 0.27.0) |
| golang.org/x/text | v0.14.0 | Unknown | CVE-2026-56851 (golang.org/x/text: golang.org/x/text: Denial of Service via out-of-bounds slice error in Nickname profile) | HIGH | fixed (in 0.41.0) |
| github.com/Azure/azure-sdk-for-go/sdk/azidentity | v1.5.1 | Unknown | CVE-2024-35255 (azure-identity: Azure Identity Libraries Elevation of Privilege Vulnerability in github.com/Azure/azure-sdk-for-go/sdk/azidentity) | MEDIUM | fixed (in 1.6.0-beta.4.0.20240610221955-50774cd97099) |
| go.mongodb.org/mongo-driver | v1.14.0 | Unknown | CVE-2026-2303 (CVE-2026-2303 affecting package telegraf for versions less than 1.29.4-21) | MEDIUM | fixed (in 1.17.7) |
| go.opentelemetry.io/otel/bridge/opentracing | v1.21.0 | Unknown | CVE-2026-45404 (go.opentelemetry.io/otel/bridge/opentracing: OpenTelemetry-Go: Denial of Service via unsynchronized baggage map) | MEDIUM | fixed (in 1.45.0) |
| go.opentelemetry.io/otel/exporters/otlp/otlptrace/otlptracehttp | v1.24.0 | Unknown | CVE-2026-39882 (github.com/open-telemetry/opentelemetry-go: OpenTelemetry-Go: Memory exhaustion via uncapped HTTP response body reading) | MEDIUM | fixed (in 1.43.0) |
| github.com/cilium/ebpf | v0.11.0 | Unknown | CVE-2026-10722 (github.com/cilium/ebpf: Cilium ebpf: Denial of Service via integer overflow) | LOW | fixed (in 0.22.0) |
| go.opentelemetry.io/otel/exporters/otlp/otlptrace | v1.24.0 | Unknown | CVE-2026-81870 (github.com/open-telemetry/opentelemetry-go: OpenTelemetry-Go: Information disclosure via exporter configuration logging) | LOW | fixed (in 1.45.0) |
| go.opentelemetry.io/otel/exporters/otlp/otlptrace/otlptracegrpc | v1.24.0 | Unknown | CVE-2026-81870 (github.com/open-telemetry/opentelemetry-go: OpenTelemetry-Go: Information disclosure via exporter configuration logging) | LOW | fixed (in 1.45.0) |
| busybox | 1.36.1 | Unknown | - | ||
| cloud.google.com/go | v0.112.0 | Unknown | - | ||
| cloud.google.com/go/compute/metadata | v0.2.3 | Unknown | - | ||
| cloud.google.com/go/iam | v1.1.6 | Unknown | - | ||
| cloud.google.com/go/storage | v1.36.0 | Unknown | - | ||
| cloud.google.com/go/trace | v1.10.5 | Unknown | - | ||
| github.com/Azure/azure-sdk-for-go/sdk/azcore | v1.10.0 | Unknown | - | ||
| github.com/Azure/azure-sdk-for-go/sdk/internal | v1.5.2 | Unknown | - | ||
| github.com/Azure/azure-sdk-for-go/sdk/storage/azblob | v1.3.0 | Unknown | - | ||
| github.com/AzureAD/microsoft-authentication-library-for-go | v1.2.1 | Unknown | - | ||
| github.com/GoogleCloudPlatform/opentelemetry-operations-go/exporter/trace | v1.8.3 | Unknown | - | ||
| github.com/GoogleCloudPlatform/opentelemetry-operations-go/internal/resourcemapping | v0.32.3 | Unknown | - | ||
| github.com/KimMachineGun/automemlimit | v0.5.0 | Unknown | - | ||
| github.com/alecthomas/kingpin | v1.3.8-0.20210301060133-17f40c25f497 | Unknown | - | ||
| github.com/alecthomas/template | v0.0.0-20190718012654-fb15b899a751 | Unknown | - | ||
| github.com/alecthomas/units | v0.0.0-20231202071711-9a357b53e9c9 | Unknown | - | ||
| github.com/aliyun/aliyun-oss-go-sdk | v2.2.2+incompatible | Unknown | - | ||
| github.com/armon/go-radix | v1.0.0 | Unknown | - | ||
| github.com/asaskevich/govalidator | v0.0.0-20230301143203-a9d515a09cc2 | Unknown | - | ||
| github.com/aws/aws-sdk-go | v1.50.32 | Unknown | - | ||
| github.com/aws/aws-sdk-go-v2 | v1.16.0 | Unknown | - | ||
| github.com/aws/aws-sdk-go-v2/config | v1.15.1 | Unknown | - | ||
| github.com/aws/aws-sdk-go-v2/credentials | v1.11.0 | Unknown | - | ||
| github.com/aws/aws-sdk-go-v2/feature/ec2/imds | v1.12.1 | Unknown | - | ||
| github.com/aws/aws-sdk-go-v2/internal/configsources | v1.1.7 | Unknown | - | ||
| github.com/aws/aws-sdk-go-v2/internal/endpoints/v2 | v2.4.1 | Unknown | - | ||
| github.com/aws/aws-sdk-go-v2/internal/ini | v1.3.8 | Unknown | - | ||
| github.com/aws/aws-sdk-go-v2/service/internal/presigned-url | v1.9.1 | Unknown | - | ||
| github.com/aws/aws-sdk-go-v2/service/sso | v1.11.1 | Unknown | - | ||
| github.com/aws/aws-sdk-go-v2/service/sts | v1.16.1 | Unknown | - | ||
| github.com/aws/smithy-go | v1.11.1 | Unknown | - | ||
| github.com/baidubce/bce-sdk-go | v0.9.111 | Unknown | - | ||
| github.com/bboreham/go-loser | v0.0.0-20230920113527-fcc2c21820a3 | Unknown | - | ||
| github.com/beorn7/perks | v1.0.1 | Unknown | - | ||
| github.com/blang/semver/v4 | v4.0.0 | Unknown | - | ||
| github.com/cenkalti/backoff/v4 | v4.2.1 | Unknown | - | ||
| github.com/cespare/xxhash | v1.1.0 | Unknown | - | ||
| github.com/cespare/xxhash/v2 | v2.2.0 | Unknown | - | ||
| github.com/clbanning/mxj | v1.8.4 | Unknown | - | ||
| github.com/containerd/cgroups/v3 | v3.0.3 | Unknown | - | ||
| github.com/coreos/go-systemd/v22 | v22.5.0 | Unknown | - | ||
| github.com/davecgh/go-spew | v1.1.2-0.20180830191138-d8f796af33cc | Unknown | - | ||
| github.com/dennwc/varint | v1.0.0 | Unknown | - | ||
| github.com/docker/go-units | v0.5.0 | Unknown | - | ||
| github.com/dustin/go-humanize | v1.0.1 | Unknown | - | ||
| github.com/edsrzf/mmap-go | v1.1.0 | Unknown | - | ||
| github.com/efficientgo/core | v1.0.0-rc.2 | Unknown | - | ||
| github.com/efficientgo/tools/extkingpin | v0.0.0-20220817170617-6c25e3b627dd | Unknown | - | ||
| github.com/elastic/go-sysinfo | v1.8.1 | Unknown | - | ||
| github.com/facette/natsort | v0.0.0-20181210072756-2cd4dd1e2dcb | Unknown | - | ||
| github.com/felixge/fgprof | v0.9.2 | Unknown | - | ||
| github.com/felixge/httpsnoop | v1.0.4 | Unknown | - | ||
| github.com/fsnotify/fsnotify | v1.7.0 | Unknown | - | ||
| github.com/go-kit/kit | v0.12.0 | Unknown | - | ||
| github.com/go-kit/log | v0.2.1 | Unknown | - | ||
| github.com/go-logfmt/logfmt | v0.6.0 | Unknown | - | ||
| github.com/go-logr/logr | v1.4.1 | Unknown | - | ||
| github.com/go-logr/stdr | v1.2.2 | Unknown | - | ||
| github.com/go-openapi/analysis | v0.22.2 | Unknown | - | ||
| github.com/go-openapi/errors | v0.21.1 | Unknown | - | ||
| github.com/go-openapi/jsonpointer | v0.20.2 | Unknown | - | ||
| github.com/go-openapi/jsonreference | v0.20.4 | Unknown | - | ||
| github.com/go-openapi/loads | v0.21.5 | Unknown | - | ||
| github.com/go-openapi/runtime | v0.27.1 | Unknown | - | ||
| github.com/go-openapi/spec | v0.20.14 | Unknown | - | ||
| github.com/go-openapi/strfmt | v0.22.2 | Unknown | - | ||
| github.com/go-openapi/swag | v0.22.9 | Unknown | - | ||
| github.com/go-openapi/validate | v0.23.0 | Unknown | - | ||
| github.com/godbus/dbus/v5 | v5.0.4 | Unknown | - | ||
| github.com/gofrs/flock | v0.8.1 | Unknown | - | ||
| github.com/gogo/googleapis | v1.4.0 | Unknown | - | ||
| github.com/gogo/protobuf | v1.3.2 | Unknown | - | ||
| github.com/gogo/status | v1.1.1 | Unknown | - | ||
| github.com/golang/groupcache | v0.0.0-20210331224755-41bb18bfe9da | Unknown | - | ||
| github.com/golang/protobuf | v1.5.4 | Unknown | - | ||
| github.com/golang/snappy | v0.0.4 | Unknown | - | ||
| github.com/google/go-cmp | v0.6.0 | Unknown | - | ||
| github.com/google/go-querystring | v1.1.0 | Unknown | - | ||
| github.com/google/pprof | v0.0.0-20240227163752-401108e1b7e7 | Unknown | - | ||
| github.com/google/s2a-go | v0.1.7 | Unknown | - | ||
| github.com/google/uuid | v1.6.0 | Unknown | - | ||
| github.com/googleapis/enterprise-certificate-proxy | v0.3.2 | Unknown | - | ||
| github.com/googleapis/gax-go/v2 | v2.12.2 | Unknown | - | ||
| github.com/gorilla/mux | v1.8.0 | Unknown | - | ||
| github.com/grafana/regexp | v0.0.0-20221122212121-6b5c0a4cb7fd | Unknown | - | ||
| github.com/grpc-ecosystem/go-grpc-middleware/providers/kit/v2 | v2.0.0-20201002093600-73cf2ae9d891 | Unknown | - | ||
| github.com/grpc-ecosystem/go-grpc-middleware/v2 | v2.0.0-rc.2.0.20201207153454-9f6bf00c00a7 | Unknown | - | ||
| github.com/grpc-ecosystem/go-grpc-prometheus | v1.2.0 | Unknown | - | ||
| github.com/grpc-ecosystem/grpc-gateway/v2 | v2.19.0 | Unknown | - | ||
| github.com/hashicorp/go-version | v1.6.0 | Unknown | - | ||
| github.com/hashicorp/golang-lru/v2 | v2.0.7 | Unknown | - | ||
| github.com/huaweicloud/huaweicloud-sdk-go-obs | v3.23.3+incompatible | Unknown | - | ||
| github.com/jmespath/go-jmespath | v0.4.0 | Unknown | - | ||
| github.com/joeshaw/multierror | v0.0.0-20140124173710-69b34d4ec901 | Unknown | - | ||
| github.com/josharian/intern | v1.0.0 | Unknown | - | ||
| github.com/jpillora/backoff | v1.0.0 | Unknown | - | ||
| github.com/json-iterator/go | v1.1.12 | Unknown | - | ||
| github.com/julienschmidt/httprouter | v1.3.0 | Unknown | - | ||
| github.com/klauspost/cpuid/v2 | v2.2.5 | Unknown | - | ||
| github.com/kylelemons/godebug | v1.1.0 | Unknown | - | ||
| github.com/lightstep/lightstep-tracer-common/golang/gogo | v0.0.0-20210210170715-a8dfcb80d3a7 | Unknown | - | ||
| github.com/lightstep/lightstep-tracer-go | v0.25.0 | Unknown | - | ||
| github.com/mailru/easyjson | v0.7.7 | Unknown | - | ||
| github.com/mattn/go-runewidth | v0.0.13 | Unknown | - | ||
| github.com/metalmatze/signal | v0.0.0-20210307161603-1c9aa721a97a | Unknown | - | ||
| github.com/miekg/dns | v1.1.58 | Unknown | - | ||
| github.com/minio/md5-simd | v1.1.2 | Unknown | - | ||
| github.com/minio/minio-go/v7 | v7.0.61 | Unknown | - | ||
| github.com/minio/sha256-simd | v1.0.1 | Unknown | - | ||
| github.com/mitchellh/go-ps | v1.0.0 | Unknown | - | ||
| github.com/mitchellh/mapstructure | v1.5.0 | Unknown | - | ||
| github.com/modern-go/concurrent | v0.0.0-20180306012644-bacd9c7ef1dd | Unknown | - | ||
| github.com/modern-go/reflect2 | v1.0.2 | Unknown | - | ||
| github.com/mozillazg/go-httpheader | v0.2.1 | Unknown | - | ||
| github.com/munnerz/goautoneg | v0.0.0-20191010083416-a7dc8b61c822 | Unknown | - | ||
| github.com/mwitkow/go-conntrack | v0.0.0-20190716064945-2f068394615f | Unknown | - | ||
| github.com/ncw/swift | v1.0.53 | Unknown | - | ||
| github.com/oklog/run | v1.1.0 | Unknown | - | ||
| github.com/oklog/ulid | v1.3.1 | Unknown | - | ||
| github.com/olekukonko/tablewriter | v0.0.5 | Unknown | - | ||
| github.com/opencontainers/runtime-spec | v1.0.2 | Unknown | - | ||
| github.com/opentracing-contrib/go-grpc | v0.0.0-20210225150812-73cb765af46e | Unknown | - | ||
| github.com/opentracing-contrib/go-stdlib | v1.0.0 | Unknown | - | ||
| github.com/opentracing/opentracing-go | v1.2.0 | Unknown | - | ||
| github.com/oracle/oci-go-sdk/v65 | v65.41.1 | Unknown | - | ||
| github.com/pbnjay/memory | v0.0.0-20210728143218-7b4eea64cf58 | Unknown | - | ||
| github.com/pkg/browser | v0.0.0-20240102092130-5ac0b6a4141c | Unknown | - | ||
| github.com/pkg/errors | v0.9.1 | Unknown | - | ||
| github.com/pmezard/go-difflib | v1.0.1-0.20181226105442-5d4384ee4fb2 | Unknown | - | ||
| github.com/prometheus-community/prom-label-proxy | v0.8.1-0.20240127162815-c1195f9aabc0 | Unknown | - | ||
| github.com/prometheus/alertmanager | v0.27.0 | Unknown | - | ||
| github.com/prometheus/client_golang | v1.19.0 | Unknown | - | ||
| github.com/prometheus/client_model | v0.6.0 | Unknown | - | ||
| github.com/prometheus/common | v0.49.1-0.20240306132007-4199f18c3e92 | Unknown | - | ||
| github.com/prometheus/common/sigv4 | v0.1.0 | Unknown | - | ||
| github.com/prometheus/exporter-toolkit | v0.11.0 | Unknown | - | ||
| github.com/prometheus/procfs | v0.12.0 | Unknown | - | ||
| github.com/redis/rueidis | v1.0.14-go1.18 | Unknown | - | ||
| github.com/rivo/uniseg | v0.2.0 | Unknown | - | ||
| github.com/rs/xid | v1.5.0 | Unknown | - | ||
| github.com/sercand/kuberesolver/v4 | v4.0.0 | Unknown | - | ||
| github.com/shirou/gopsutil/v3 | v3.22.9 | Unknown | - | ||
| github.com/simonpasquier/klog-gokit/v3 | v3.0.0 | Unknown | - | ||
| github.com/sirupsen/logrus | v1.9.3 | Unknown | - | ||
| github.com/sony/gobreaker | v0.5.0 | Unknown | - | ||
| github.com/stretchr/testify | v1.9.0 | Unknown | - | ||
| github.com/tencentyun/cos-go-sdk-v5 | v0.7.40 | Unknown | - | ||
| github.com/thanos-community/galaxycache | v0.0.0-20211122094458-3a32041a1f1e | Unknown | - | ||
| github.com/thanos-io/objstore | v0.0.0-20240309075357-e8336a5fd5f3 | Unknown | - | ||
| github.com/thanos-io/promql-engine | v0.0.0-20240405095051-b7d0da367508 | Unknown | - | ||
| github.com/thanos-io/thanos | v0.0.0-20240528131933-086a698b2195 | Unknown | - | ||
| github.com/themihai/gomemcache | v0.0.0-20180902122335-24332e2d58ab | Unknown | - | ||
| github.com/tklauser/go-sysconf | v0.3.10 | Unknown | - | ||
| github.com/tklauser/numcpus | v0.4.0 | Unknown | - | ||
| github.com/uber/jaeger-client-go | v2.30.0+incompatible | Unknown | - | ||
| github.com/uber/jaeger-lib | v2.4.1+incompatible | Unknown | - | ||
| github.com/weaveworks/common | v0.0.0-20230728070032-dd9e68f319d5 | Unknown | - | ||
| github.com/weaveworks/promrus | v1.2.0 | Unknown | - | ||
| github.com/zhangyunhao116/umap | v0.0.0-20221211160557-cb7705fafa39 | Unknown | - | ||
| go.elastic.co/apm | v1.11.0 | Unknown | - | ||
| go.elastic.co/apm/module/apmhttp | v1.11.0 | Unknown | - | ||
| go.elastic.co/apm/module/apmot | v1.11.0 | Unknown | - | ||
| go.elastic.co/fastjson | v1.1.0 | Unknown | - | ||
| go.opencensus.io | v0.24.0 | Unknown | - | ||
| go.opentelemetry.io/collector/featuregate | v1.3.0 | Unknown | - | ||
| go.opentelemetry.io/collector/pdata | v1.3.0 | Unknown | - | ||
| go.opentelemetry.io/collector/semconv | v0.96.0 | Unknown | - | ||
| go.opentelemetry.io/contrib/instrumentation/google.golang.org/grpc/otelgrpc | v0.49.0 | Unknown | - | ||
| go.opentelemetry.io/contrib/instrumentation/net/http/otelhttp | v0.49.0 | Unknown | - | ||
| go.opentelemetry.io/contrib/propagators/autoprop | v0.38.0 | Unknown | - | ||
| go.opentelemetry.io/contrib/propagators/aws | v1.13.0 | Unknown | - | ||
| go.opentelemetry.io/contrib/propagators/b3 | v1.13.0 | Unknown | - | ||
| go.opentelemetry.io/contrib/propagators/jaeger | v1.13.0 | Unknown | - | ||
| go.opentelemetry.io/contrib/propagators/ot | v1.13.0 | Unknown | - | ||
| go.opentelemetry.io/contrib/samplers/jaegerremote | v0.7.0 | Unknown | - | ||
| go.opentelemetry.io/otel | v1.24.0 | Unknown | - | ||
| go.opentelemetry.io/otel/exporters/jaeger | v1.16.0 | Unknown | - | ||
| go.opentelemetry.io/otel/metric | v1.24.0 | Unknown | - | ||
| go.opentelemetry.io/otel/trace | v1.24.0 | Unknown | - | ||
| go.opentelemetry.io/proto/otlp | v1.1.0 | Unknown | - | ||
| go.uber.org/atomic | v1.11.0 | Unknown | - | ||
| go.uber.org/automaxprocs | v1.5.3 | Unknown | - | ||
| go.uber.org/goleak | v1.3.0 | Unknown | - | ||
| go.uber.org/multierr | v1.11.0 | Unknown | - | ||
| go4.org/intern | v0.0.0-20230525184215-6c62f75575cb | Unknown | - | ||
| go4.org/unsafe/assume-no-moving-gc | v0.0.0-20230525183740-e7c30c78aeb2 | Unknown | - | ||
| golang.org/x/exp | v0.0.0-20240119083558-1b970713d09a | Unknown | - | ||
| golang.org/x/sync | v0.6.0 | Unknown | - | ||
| golang.org/x/sys | v0.18.0 | Unknown | CVE-2026-39824 (Invoking integer overflow in NewNTUnicodeString in golang.org/x/sys/windows) | UNKNOWN | fixed (in 0.44.0) |
| golang.org/x/time | v0.5.0 | Unknown | - | ||
| gonum.org/v1/gonum | v0.12.0 | Unknown | - | ||
| google.golang.org/api | v0.168.0 | Unknown | - | ||
| google.golang.org/genproto | v0.0.0-20240205150955-31a09d347014 | Unknown | - | ||
| google.golang.org/genproto/googleapis/api | v0.0.0-20240304212257-790db918fca8 | Unknown | - | ||
| google.golang.org/genproto/googleapis/rpc | v0.0.0-20240304161311-37d4d3c04a78 | Unknown | - | ||
| google.golang.org/protobuf | v1.33.0 | Unknown | - | ||
| gopkg.in/ini.v1 | v1.67.0 | Unknown | - | ||
| gopkg.in/yaml.v2 | v2.4.0 | Unknown | - | ||
| gopkg.in/yaml.v3 | v3.0.1 | Unknown | - | ||
| howett.net/plist | v0.0.0-20181124034731-591f970eefbb | Unknown | - | ||
| k8s.io/apimachinery | v0.29.3 | Unknown | - | ||
| k8s.io/client-go | v0.29.3 | Unknown | - | ||
| k8s.io/utils | v0.0.0-20230726121419-3b25d923346b | Unknown | - | ||
| stdlib | go1.21.10 | BSD-3-Clause | - | ||
| busybox | 1.36.1 | Unknown | - | ||
| /bin/[ | Unknown | Unknown | - | ||
| /bin/thanos | Unknown | Unknown | - |