What is the CVSS score of EUVD-2026-44862?

EUVD-2026-44862 has a CVSS 3.1 base score of 7.5 (High). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H. EPSS exploitation probability: 0.3%.

Which versions of Grafana Loki are affected by EUVD-2026-44862?

Grafana Loki is vulnerable to remote denial of service through malicious queries with excessively large parameters, enabling any unauthenticated attacker to exhaust system memory and disable…

How to fix or mitigate EUVD-2026-44862?

Within 24 hours, identify all Grafana Loki deployments accessible from untrusted networks and apply immediate rate limiting to query endpoints via reverse proxy or WAF rules targeting /loki/api/v1/query. Within 7 days, implement query parameter validation enforcing maximum limit values (recommended ≤10,000) and deploy per-query memory and CPU resource caps at the container or pod level. Within 30 days, establish monitoring for oversized query attempts, horizontally scale Loki across multiple instances if currently single-binary to distribute memory load, and maintain vendor contact for CVE-2026-21729 patch availability.

Grafana Loki EUVD-2026-44862

| CVE-2026-21729 HIGH

Allocation of Resources Without Limits or Throttling (CWE-770)

2026-07-16 GRAFANA

GHSA-65p5-8cm9-qcxx

Denial Of Service Red Hat Grafana Suse Loki

7.5

CVSS 3.1 · Vendor: GRAFANA

Severity by source

Vendor (GRAFANA) PRIMARY

7.5 HIGH

AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

vuln.today AI

7.5 HIGH

Network-reachable query API, low-complexity oversized-limit request, no auth modeled (PR:N), and pure availability impact via memory exhaustion (A:H, C:N, I:N).

3.1 AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

4.0 AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N

SUSE

HIGH

qualitative

Red Hat

7.5 HIGH

qualitative

Primary rating from Vendor (GRAFANA).

CVSS VectorVendor: GRAFANA

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Unchanged

Confidentiality

None

Integrity

None

Availability

High

Lifecycle Timeline

Analysis Generated

Jul 16, 2026 - 03:46 vuln.today

CVE Published

Jul 16, 2026 - 03:12 cve.org

HIGH 7.5

DescriptionCVE.org

Loki queries with large limits can cause large memory allocations which can impact the availability of the service, depending on its deployment strategy.

AnalysisAI

Uncontrolled memory allocation in Grafana Loki lets remote unauthenticated users issue queries with excessively large limit values, forcing the service to allocate large amounts of memory and potentially exhausting host resources. The impact is denial of service (CVSS 7.5, A:H only) and varies by deployment topology - a single-binary or under-provisioned deployment is far more exposed than a horizontally scaled microservices setup. There is no public exploit identified at time of analysis and it is not listed in CISA KEV; note the input 'Information Disclosure' tag conflicts with the CVSS impact (C:N/I:N/A:H), which indicates an availability-only issue.

Technical ContextAI

Grafana Loki is a horizontally scalable, multi-tenant log aggregation system (the logging counterpart to Prometheus) commonly deployed in Kubernetes and cloud-native environments and queried via LogQL through its HTTP query API. The flaw is an uncontrolled resource consumption problem: query parameters that set large result limits are honored without adequate bounding, so the querier/ingester components allocate memory proportional to the requested limit rather than to a safe ceiling. The affected component is Grafana Loki (CPE cpe:2.3:a:grafana:loki:*), and the root-cause class is CWE-770 (Allocation of Resources Without Limits or Throttling) / CWE-400 (Uncontrolled Resource Consumption), even though the input records CWE as N/A.

RemediationAI

Consult the Grafana security advisory at https://grafana.com/security/security-advisories/cve-2026-21729 and upgrade to the vendor's fixed release; the exact patched version was not included in the provided data and should be taken directly from that advisory rather than assumed (Patch available per vendor advisory). As compensating controls until patched, cap query result sizes and memory using Loki's per-tenant limits configuration - set or lower max_entries_limit_per_query and related query limits, and configure querier/ingester memory limits (and Kubernetes resource limits) so an oversized query cannot exhaust the node; the trade-off is that legitimate large queries will be rejected. Additionally, require authentication on the query API by fronting Loki with an authenticating reverse proxy or API gateway and restrict network access to the query/HTTP endpoints to trusted clients only, accepting the operational overhead of managing that access layer.