CVEvulnerability

CVE-2026-33382

7.5 HIGH Published 2026-07-10 Modified 2026-10-25 Official page ↗
Status
Analyzed
Published
2026-07-10
Last modified
2026-10-25
Assigner
[email protected]
CVSS 3.1 ([email protected])
7.5 HIGH — CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Weaknesses
CWE-400

Description

Several Grafana API endpoints, some of them unauthenticated, do not limit the size of the request body before processing it. An attacker can send very large payloads that force excessive memory allocation, potentially exhausting memory and causing a denial of service.

Affected configurations

• grafana grafana (>= 11.6.0 < 11.6.15) • grafana grafana (>= 12.2.0 < 12.2.9) • grafana grafana (>= 12.3.0 < 12.3.7) • grafana grafana (>= 12.4.0 < 12.4.4) • grafana grafana (>= 13.0.0 < 13.0.2)

Related

Weakness · CWE (1)

  • CWE-400 Uncontrolled Resource Consumption weakness

References