Is CVE-2026-21729 exploited in the wild?

No. Junglewise Threat Intelligence has no report of CVE-2026-21729 being exploited in the wild.

How severe is CVE-2026-21729?

High severity, with a CVSS score of 7.5, published 16 July 2026.

Which products and versions are affected?

Grafana Labs Loki v3.0.0 to v3.6.x (fixed in v3.7.0).

Is there a fix for CVE-2026-21729?

No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.

How is CVE-2026-21729 attacked?

It is attacked over the network, in a hosted service.

Am I affected by CVE-2026-21729?

Check whether you run Grafana Labs Loki at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2026-21729: Grafana Loki Denial of Service via Large Query Limits

CVE-2026-21729 · Severity: high · CVSS 7.5 · Published 2026-07-16

Grafana Loki, a popular log aggregation system, is vulnerable to a denial-of-service attack. An attacker can send specific queries with very large limits that force the system to allocate excessive amounts of memory. This can cause the service to crash or become unresponsive, disrupting log monitoring and alerting operations.

Vendors: Grafana Labs.

Quick answers

Is CVE-2026-21729 exploited in the wild?: No. Junglewise Threat Intelligence has no report of CVE-2026-21729 being exploited in the wild.
How severe is CVE-2026-21729?: High severity, with a CVSS score of 7.5, published 16 July 2026.
Which products and versions are affected?: Grafana Labs Loki v3.0.0 to v3.6.x (fixed in v3.7.0).
Is there a fix for CVE-2026-21729?: No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.
How is CVE-2026-21729 attacked?: It is attacked over the network, in a hosted service.
Am I affected by CVE-2026-21729?: Check whether you run Grafana Labs Loki at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

Technical details

A resource exhaustion vulnerability exists in Grafana Loki versions 3.0.0 through 3.6.x. The issue stems from insufficient validation or capping of the 'limit' parameter in log queries, allowing a remote attacker to trigger massive memory allocations. This is a classic denial-of-service (DoS) vector where the backend service attempts to fulfill a request that exceeds available system resources. The vulnerability is reachable over the network without authentication. Users are advised to upgrade to Loki v3.7.0 or later to mitigate this risk.

Affected products

Grafana Labs Loki v3.0.0 to v3.6.x (fixed in v3.7.0)

Timeline

2026-07-16: disclosed
2026-07-16: advisory

References

https://grafana.com/security/security-advisories/cve-2026-21729

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.