GitHub Advisoryadvisory · Go

GHSA-p4r4-xvrq-gvmc Grafana Tempo has an Uncontrolled Resource Consumption issue

HIGH Published 2026-04-24 Modified 2026-05-05 Official page ↗
Aliases
CVE-2026-21728
Ecosystem
Go
Packages
github.com/grafana/tempo
Severity
High
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Weaknesses
CWE-400
Reviewed
2026-05-05

Affected packages

• Go github.com/grafana/tempo: >= 1.3.0, < 2.8.4 → fixed in 2.8.4 • Go github.com/grafana/tempo: >= 2.9.0, < 2.9.2 → fixed in 2.9.2 • Go github.com/grafana/tempo: >= 2.10.0, < 2.10.2 → fixed in 2.10.2

Description

Tempo queries with large limits can cause large memory allocations which can impact the availability of the service, depending on its deployment strategy. Mitigation can be done by setting max_result_limit in the search config, e.g. to 262144 (2^18).

Related

Alias · CVE (1)

  • CVE-2026-21728 Tempo queries with large limits can cause large memory allocations which can impact the availability of the service, depending on its… vulnerability

Weakness · CWE (1)

  • CWE-400 Uncontrolled Resource Consumption weakness

References