Is CVE-2026-33382 exploited in the wild?

No. Junglewise Threat Intelligence has no report of CVE-2026-33382 being exploited in the wild.

How severe is CVE-2026-33382?

High severity, with a CVSS score of 7.5, published 10 July 2026.

Which products and versions are affected?

Grafana Labs Grafana OSS 11.6.0 - 11.6.14, 12.2.0 - 12.2.8, 12.3.0 - 12.3.6, 12.4.0 - 12.4.3, 13.0.0 - 13.0.1.

Is there a fix for CVE-2026-33382?

No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.

How is CVE-2026-33382 attacked?

It is attacked over the network, in a web application.

Am I affected by CVE-2026-33382?

Check whether anything you run is named in the advisory. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2026-33382: Grafana OSS denial of service via oversized request bodies in web.Bind

CVE-2026-33382 · Severity: high · CVSS 7.5 · Published 2026-07-10

Grafana, a popular platform for monitoring and data visualization, is vulnerable to a denial-of-service attack. An attacker can send specially crafted, oversized requests to certain web interfaces, causing the system to run out of memory and crash. This can result in the monitoring platform becoming unavailable to users and administrators.

Quick answers

Is CVE-2026-33382 exploited in the wild?: No. Junglewise Threat Intelligence has no report of CVE-2026-33382 being exploited in the wild.
How severe is CVE-2026-33382?: High severity, with a CVSS score of 7.5, published 10 July 2026.
Which products and versions are affected?: Grafana Labs Grafana OSS 11.6.0 - 11.6.14, 12.2.0 - 12.2.8, 12.3.0 - 12.3.6, 12.4.0 - 12.4.3, 13.0.0 - 13.0.1.
Is there a fix for CVE-2026-33382?: No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.
How is CVE-2026-33382 attacked?: It is attacked over the network, in a web application.
Am I affected by CVE-2026-33382?: Check whether anything you run is named in the advisory. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

Technical details

A resource consumption vulnerability (CWE-400) exists in several Grafana API endpoints due to a failure to enforce request body size limits during the web.Bind process. An unauthenticated remote attacker can exploit this by sending excessively large HTTP request payloads. This forces the application to allocate significant memory to process the request, potentially leading to an Out-Of-Memory (OOM) condition and a denial of service (DoS). The issue affects multiple versions of Grafana OSS and has been addressed in versions 11.6.15, 12.2.9, 12.3.7, 12.4.4, and 13.0.2.

Affected products

Grafana Labs Grafana OSS 11.6.0 - 11.6.14, 12.2.0 - 12.2.8, 12.3.0 - 12.3.6, 12.4.0 - 12.4.3, 13.0.0 - 13.0.1

Timeline

2026-06-09: advisory: Initial advisory published by Grafana Labs
2026-07-10: disclosed: NVD publication date

References

https://grafana.com/security/security-advisories/cve-2026-33382

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.