Executive brief
Grafana Loki, a popular log aggregation system, is vulnerable to a denial-of-service attack. An attacker can send specific queries with very large limits that force the system to allocate excessive amounts of memory. This can cause the service to crash or become unresponsive, disrupting log monitoring and alerting operations.
Technical details
A resource exhaustion vulnerability exists in Grafana Loki versions 3.0.0 through 3.6.x. The issue stems from insufficient validation or capping of the 'limit' parameter in log queries, allowing a remote attacker to trigger massive memory allocations. This is a classic denial-of-service (DoS) vector where the backend service attempts to fulfill a request that exceeds available system resources. The vulnerability is reachable over the network without authentication. Users are advised to upgrade to Loki v3.7.0 or later to mitigate this risk.
Affected products
- Grafana Labs Loki v3.0.0 to v3.6.x (fixed in v3.7.0)
Timeline
- 2026-07-16: disclosed
- 2026-07-16: advisory