What did you do?

The Prometheus text format and OpenMetrics parsers panic when they encounter an
entry whose line starts with { and contains a bare (unquoted) identifier not
followed by =, such as {A}0. Because the scrape pipeline has no panic
recovery, this crashes the entire Prometheus process.

Affected parsers: PromParser (text/plain) and OpenMetricsParser
(application/openmetrics-text)

Steps to reproduce

Stand up any HTTP endpoint returning this body with Content-Type: text/plain:

{A}0

Point a Prometheus instance at it. The collector crashes on the first scrape.

The panic can also be reproduced in isolation:

package main

import (
	"github.com/prometheus/prometheus/model/labels"
	"github.com/prometheus/prometheus/model/textparse"
)

// Run against unpatched code: panic: runtime error: slice bounds out of range [2:1]
func main() {
	p, _ := textparse.New([]byte("{A} 0\n"), "application/openmetrics-text", nil, textparse.ParserOptions{})
	p.Next()
	var lset labels.Labels
	p.Labels(&lset)
}

package main

import (
	"github.com/prometheus/prometheus/model/labels"
	"github.com/prometheus/prometheus/model/textparse"
)

// Run against unpatched code: panic: runtime error: slice bounds out of range [2:1]
func main() {
	p, _ := textparse.New([]byte("{A}0\n"), "text/plain", nil, textparse.ParserOptions{})
	p.Next()
	var lset labels.Labels
	p.Labels(&lset)
}

What did you expect to see?

The parser returns a parse error from Next() and the scrape loop logs it and
continues normally, as it does for any other malformed metric line.

What did you see instead? Under which circumstances?

Next() returns (EntrySeries, nil) — no error — because the corrupt offsets
are not detected at parse time. The panic is deferred to the subsequent
Labels() call:

goroutine N [running]:
github.com/prometheus/prometheus/model/textparse.(*PromParser).Labels(...)
    model/textparse/promparse.go:237
panic: runtime error: slice bounds out of range [2:1]

Prometheus version

I'm able to reproduce this on main.