CVEvulnerability

CVE-2026-21720

7.5 HIGH Published 2026-01-27 Modified 2026-07-15 Official page ↗
Status
Modified
Published
2026-01-27
Last modified
2026-07-15
Assigner
[email protected]
CVSS 3.1 ([email protected])
7.5 HIGH — CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
CVSS 3.1 (0b0ca135-0b70-47e7-9f44-1890c2a1c46c)
7.5 HIGH — CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Weaknesses
CWE-400, CWE-703, CWE-772

Description

Every uncached /avatar/:hash request spawns a goroutine that refreshes the Gravatar image. If the refresh sits in the 10-slot worker queue longer than three seconds, the handler times out and stops listening for the result, so that goroutine blocks forever trying to send on an unbuffered channel. Sustained traffic with random hashes keeps tripping this timeout, so goroutine count grows linearly, eventually exhausting memory and causing Grafana to crash on some systems.

Affected configurations

• grafana grafana (>= 3.0.0 < 11.6.9) • grafana grafana (>= 12.0.0 < 12.0.8) • grafana grafana (>= 12.1.0 < 12.1.5) • grafana grafana (>= 12.2.0 < 12.2.3) • grafana grafana 12.3.0

Related

Weakness · CWE (3)

  • CWE-400 Uncontrolled Resource Consumption weakness
  • CWE-703 Improper Check or Handling of Exceptional Conditions weakness
  • CWE-772 Missing Release of Resource after Effective Lifetime weakness

References