Executive brief
Grafana Tempo, a tool used for managing and searching large amounts of application tracing data, is vulnerable to a denial-of-service attack. An attacker can send specially crafted search queries with very high result limits, causing the system to consume excessive amounts of memory. This can lead to service crashes or significant performance degradation, preventing users from accessing their monitoring data.
Technical details
A resource consumption vulnerability (CWE-400) exists in Grafana Tempo versions 1.3.0 through 2.10.x. The issue stems from insufficient validation of the result limit parameter in search queries. A remote, unauthenticated attacker can trigger large memory allocations by submitting queries with extremely high limits, potentially exhausting available system memory and causing a denial-of-service (DoS) condition. The impact varies based on the deployment strategy and available resources. Users are advised to upgrade to version 2.11.0 or later, or mitigate the risk by configuring 'max_result_limit' in the search configuration (e.g., to 262144).
Affected products
- Grafana Tempo >= 1.3.0, < 2.11.0
Timeline
- 2026-04-24: advisory: Initial advisory published by Grafana Labs
- 2026-04-24: disclosed: CVE-2026-21728 published to NVD