CVEvulnerability

CVE-2026-33374

6.5 MEDIUM Published 2026-10-13 Modified 2026-10-16 Official page ↗

Status: Awaiting Analysis
Published: 2026-10-13
Last modified: 2026-10-16
Assigner: [email protected]
CVSS 3.1 ([email protected]): 6.5 MEDIUM — CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H
Weaknesses: CWE-400, CWE-770, CWE-789

Description

The Prometheus rule conversion API endpoints in Grafana do not limit request body size, allowing authenticated users to trigger unbounded memory allocations that can crash the server through out-of-memory conditions.

Weakness · CWE (3)

CWE-400 Uncontrolled Resource Consumption weakness
CWE-770 Allocation of Resources Without Limits or Throttling weakness
CWE-789 Memory Allocation with Excessive Size Value weakness

References

https://grafana.com/security/security-advisories/cve-2026-33374 grafana.com

CVE-2026-33374

Description

Related

Weakness · CWE (3)

References