GitHub Advisoryadvisory · Go
GHSA-6xff-cpcq-vpw2 Grafana Tempo vulnerable to an out-of-memory crash
MEDIUM
Official page ↗
- Aliases
- CVE-2026-27878
- Ecosystem
- Go
- Packages
- github.com/grafana/tempo
- Severity
- Moderate
- CVSS vector
- CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H
- Weaknesses
- CWE-400
- Reviewed
- 2026-08-28
Affected packages
• Go github.com/grafana/tempo: < 1.5.1-0.20260303204923-b13f74291d48 → fixed in 1.5.1-0.20260303204923-b13f74291d48
Description
A TraceQL query in Grafana Tempo with a large exemplars hint value can cause the Tempo instance to allocate an excessive amount of memory, resulting in an out-of-memory crash. This could allow an authenticated user to trigger a denial of service against the Tempo service.
Related
Alias · CVE (1)
- CVE-2026-27878 A TraceQL query in Grafana Tempo with a large exemplars hint value can cause the Tempo instance to allocate an excessive amount of memory,… vulnerability
Weakness · CWE (1)
- CWE-400 Uncontrolled Resource Consumption weakness
References
- https://nvd.nist.gov/vuln/detail/CVE-2026-27878 advisory
- https://github.com/grafana/tempo/pull/6559 web
- https://github.com/grafana/tempo/pull/6646 web
- https://github.com/grafana/tempo/pull/6792 web
- https://github.com/grafana/tempo/pull/6802 web
- https://github.com/grafana/tempo/commit/3d7c78d438890991df594c20ae2031f8934aba3b web
- https://github.com/grafana/tempo/commit/b13f74291d489672601a10297f8fbcbf7dd19192 web
- https://github.com/grafana/tempo/commit/b481ae9693f99785691197915066e6306950fa09 web
- https://github.com/grafana/tempo/commit/e2d51b786aff94de3319c07994c6a5539b121eb5 web
- https://github.com/grafana/tempo package
- https://github.com/grafana/tempo/releases/tag/v2.10.2 web
- https://github.com/grafana/tempo/releases/tag/v2.8.4 web
- https://github.com/grafana/tempo/releases/tag/v2.9.2 web
- https://grafana.com/security/security-advisories/cve-2026-27878 web