Executive brief
Grafana is a popular data visualization and monitoring platform. A vulnerability in how it handles plugin requests allows a logged-in user to crash the server by sending a specially crafted request that consumes all available system memory. This can lead to a total service outage, preventing teams from monitoring their infrastructure.
Technical details
The vulnerability is classified as CWE-770 (Allocation of Resources Without Limits or Throttling) within the Grafana plugin resources endpoint. The root cause is that the application reads the entire request body into memory without enforcing size limits. An authenticated attacker with network access can send a large request body to this endpoint, leading to unbounded memory allocation. This results in an Out-of-Memory (OOM) condition that crashes the Grafana process, causing a Denial of Service (DoS). Patches have been released in versions 11.6.14, 12.2.8, 12.3.6, 12.4.3, and 13.0.1.
Affected products
- Grafana Labs Grafana 8.5.0 to < 11.6.14, 12.2.0 to < 12.2.8, 12.3.0 to < 12.3.6, 12.4.0 to < 12.4.3, 13.0.0 to < 13.0.1
Timeline
- 2026-05-13: disclosed
- 2026-05-13: advisory
- 2026-05-13: patched