Executive brief
Grafana is an open-source platform used for monitoring and visualizing data from various sources. A vulnerability in how it handles specific database queries allows an attacker to crash the server by exhausting its memory. While the attack is slow and may take up to 30 minutes to succeed, it can lead to service outages if the server is not configured to restart automatically.
Technical details
A denial-of-service vulnerability exists in Grafana's SQL data source plugin due to uncontrolled resource consumption (CWE-400). The root cause is a 'Negative Interval Injection' within the $__timeGroup macro. An authenticated attacker with network access can craft a query that causes the server to overload and eventually trigger an Out-of-Memory (OOM) crash. The exploit is relatively slow, often requiring up to 30 minutes of sustained load to achieve a crash. The issue is resolved in versions 11.6.14, 12.2.8, 12.3.6, 12.4.3, and 13.0.1 (and their respective security-specific releases).
Affected products
- Grafana Labs Grafana 8.0.0 to 11.6.14, 12.0.0 to 12.2.8, 12.3.0 to 12.3.6, 12.4.0 to 12.4.3, 13.0.0 to 13.0.1
Timeline
- 2026-05-13: disclosed
- 2026-05-13: advisory
- 2026-05-13: patched