Cortex Files

1.21.1 2026-06-04

• [BUGFIX] gRPC: Fix panic when grpc_compression is set to snappy on ingester client or store-gateway client configurations. [#7459]
• [BUGFIX] Config: Mask Swift, etcd, Redis, and HTTP basic-auth credentials on the /config endpoint. [#7473]
• [BUGFIX] Memberlist: Drop incoming TCP transport packets when digest verification fails, preventing corrupted payloads from being forwarded. [#7474]
• [BUGFIX] Ingester: Reject PushStream requests where the per-message TenantID does not match the authenticated caller, and add HMAC-SHA256 stream authentication for PushStream via -distributor.sign-write-requests-keys. [#7475]
• [BUGFIX] Security: Fix stored XSS vulnerability in Alertmanager and Store Gateway status pages by replacing text/template with html/template. [#7512]
• [BUGFIX] Security: Limit decompressed gzip output in ParseProtoReader and OTLP ingestion path. The decompressed body is now capped by -distributor.otlp-max-recv-msg-size. [#7515]
• [BUGFIX] Memberlist: Add -memberlist.packet-read-timeout, -memberlist.max-packet-size, and -memberlist.max-concurrent-connections flags to bound inbound gossip TCP connections, preventing slow-read, OOM, and connection-flood attacks on the gossip port. [#7518]
• [BUGFIX] Distributor: Fix a panic (slice bounds out of range) in the stream push path when the context deadline expires while the worker goroutine is still marshalling a WriteRequest. [#7541]
• [BUGFIX] Distributor: Add WrappedHistogram with configurable size limit (-validation.max-native-histogram-size-bytes, default 16 KB) to cap native histogram protobuf size before unmarshalling, preventing memory amplification attacks via packed varint deltas. [#7570]

What's Changed

• Backport security audit fixes (V01-V07), snappy gRPC fix, and stream push panic fix to release-1.21 by @friedrichg in https://github.com/cortexproject/cortex/pull/7574
• Prepare release 1.21.1 by @friedrichg in https://github.com/cortexproject/cortex/pull/7588

Full Changelog: https://github.com/cortexproject/cortex/compare/v1.21.0...v1.21.1