Executive brief
Grafana, a popular platform for monitoring and data visualization, is vulnerable to a denial-of-service attack. An attacker can send specially crafted, oversized requests to certain web interfaces, causing the system to run out of memory and crash. This can result in the monitoring platform becoming unavailable to users and administrators.
Technical details
A resource consumption vulnerability (CWE-400) exists in several Grafana API endpoints due to a failure to enforce request body size limits during the web.Bind process. An unauthenticated remote attacker can exploit this by sending excessively large HTTP request payloads. This forces the application to allocate significant memory to process the request, potentially leading to an Out-Of-Memory (OOM) condition and a denial of service (DoS). The issue affects multiple versions of Grafana OSS and has been addressed in versions 11.6.15, 12.2.9, 12.3.7, 12.4.4, and 13.0.2.
Affected products
- Grafana Labs Grafana OSS 11.6.0 - 11.6.14, 12.2.0 - 12.2.8, 12.3.0 - 12.3.6, 12.4.0 - 12.4.3, 13.0.0 - 13.0.1
Timeline
- 2026-06-09: advisory: Initial advisory published by Grafana Labs
- 2026-07-10: disclosed: NVD publication date