Executive brief
Grafana is a popular platform used for monitoring and visualizing data. A vulnerability in its 'Live' push feature allows an authorized user to crash the service by sending a specially crafted, large data stream. This can lead to a complete service outage, preventing teams from monitoring their infrastructure and responding to other operational issues.
Technical details
A denial-of-service vulnerability exists in the Grafana Live push endpoint due to improper handling of request body sizes. The component fails to enforce strict limits on memory allocation when processing large or streaming request bodies. An authenticated attacker with network access to the Grafana Live API can exploit this by sending a continuous or oversized stream of data, exhausting the server's available RAM and triggering an Out-of-Memory (OOM) crash. This is classified as an unbounded memory allocation issue. While the advisory confirms the vulnerability, specific patched versions were not detailed in the provided NVD snippet.
Affected products
- Grafana Labs Grafana
Timeline
- 2026-05-13: disclosed: Initial publication of the CVE record.
- 2026-05-13: advisory: NVD entry published based on Grafana Labs data.