EUVD-2026-25408
GHSA-p4r4-xvrq-gvmc
Severity by source
AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Primary rating from Vendor (GRAFANA).
CVSS VectorVendor: GRAFANA
Lifecycle Timeline
5DescriptionCVE.org
Tempo queries with large limits can cause large memory allocations which can impact the availability of the service, depending on its deployment strategy.
Mitigation can be done by setting max_result_limit in the search config, e.g. to 262144 (2^18).
AnalysisAI
Denial of service in Grafana Tempo allows unauthenticated remote attackers to exhaust server memory by sending trace queries with excessively large result limits. The vulnerability causes unbounded memory allocation during query processing, degrading or halting service availability depending on deployment resources. EPSS data not available; no CISA KEV listing or public exploit identified at time of analysis. Mitigation available through configuration change rather than software patch.
Technical ContextAI
Grafana Tempo is a distributed tracing backend designed for high-volume trace data storage and retrieval. The vulnerability stems from insufficient validation of the 'limit' parameter in search queries, allowing callers to request arbitrarily large result sets. When processing these queries, Tempo allocates memory proportional to the requested limit before applying data retrieval operations. Without server-side enforcement of maximum result sizes, malicious or misconfigured clients can trigger memory allocations exceeding available system resources. This is a resource exhaustion vulnerability affecting the query processing pipeline. The CPE indicates all versions of Grafana Tempo are potentially affected, though specific vulnerable version ranges have not been published by the vendor.
RemediationAI
Apply the configuration-based mitigation by setting max_result_limit in Tempo's search configuration block to 262144 (2^18) or lower based on operational requirements and available memory resources. This parameter caps the maximum number of trace results returned per query, preventing unbounded memory allocations. Implementation requires modifying the Tempo configuration file (typically tempo.yaml) and restarting the service. Organizations should assess their legitimate maximum query result needs before selecting a limit value, balancing security against operational functionality. Monitor query rejection metrics post-deployment to identify clients requiring limit adjustments. For defense in depth, implement query-side rate limiting at reverse proxy or API gateway layers to restrict total query volume per client. Review https://grafana.com/security/security-advisories/cve-2026-21728 for vendor-recommended configuration examples and any subsequent patched releases that enforce default limits. Note that restricting max_result_limit may break workflows relying on large trace retrievals, requiring application-level pagination changes.
The `Release PR Merged` workflow in the github repo taosdata/grafanaplugin is subject to a command injection vulnerabili
An issue was discovered in Grafana through 7.3.4, when integrated with Zabbix. Rated critical severity (CVSS 9.8), this
A signature verification vulnerability exists in crewjam/saml. Rated critical severity (CVSS 9.8), this vulnerability is
Grafana 2.x, 3.x, and 4.x before 4.6.4 and 5.x before 5.2.3 allows authentication bypass because an attacker can generat
The SQL Expressions experimental feature of Grafana allows for the evaluation of `duckdb` queries containing user input.
Authentication bypass in Grafana OnCall through 1.16.11 lets unauthenticated remote attackers mint a valid PluginAuthTok
Insertion of sensitive information in the centralized (Grafana) logging system in ProLion CryptoSpike 3.0.15P2 allows re
A cross-site scripting (XSS) vulnerability exists in Grafana caused by combining a client path traversal and open redire
The avatar feature in Grafana 3.0.1 through 7.0.1 has an SSRF Incorrect Access Control issue. Rated high severity (CVSS
Grafana is an open-source platform for monitoring and observability. Rated high severity (CVSS 7.5), this vulnerability
Grafana 8.4.3 allows unauthenticated access via (for example) a /dashboard/snapshot/*?orgId=0 URI. Rated high severity (
Grafana 8.4.3 allows reading files via (for example) a /dashboard/snapshot/%7B%7Bconstructor.constructor'/.. Rated high
Same weakness CWE-400 – Uncontrolled Resource Consumption
View allSame technique Denial Of Service
View allVendor StatusVendor
SUSE
Severity: Important| Product | Status |
|---|---|
| SUSE Linux Enterprise Server 16.1 | Affected |
| SUSE Linux Enterprise Server for SAP applications 16.1 | Affected |
| SUSE Linux Enterprise Module for Package Hub 15 SP5 | Affected |
| SUSE Linux Enterprise Module for Package Hub 15 SP6 | Affected |
| openSUSE Leap 15.5 | Affected |
| openSUSE Leap 15.6 | Affected |
Share
External POC / Exploit Code
Leaving vuln.today