CVE-2026-33374
CVE-2026-33374 · Unbounded memory allocation in the Prometheus rule conversion API
This page contains facts from public vulnerability sources. Check the original advisory before updating.
The Prometheus rule conversion API endpoints in Grafana do not limit request body size, allowing authenticated users to trigger unbounded memory allocations that can crash the server through out-of-memory conditions.
CVSS 6.5 · Medium · EPSS 0.4% · Fix available
- Published
- Updated
Stack: system · applications
Affected products and versions
grafana
- Versions
- ≥ 12.0.0, ≤ 12.3.11: Affected (semver)
- ≥ 12.4.0, < 12.4.13: Affected (semver)
- ≥ 13.0.0, < 13.0.11: Affected (semver)
- ≥ 13.1.0, < 13.1.8: Affected (semver)
- ≥ 13.2.0, < 13.2.4: Affected (semver)
Update to 12.4.13; Update to 13.0.11; Update to 13.1.8; Update to 13.2.4
grafana Ubuntu:16.04:LTS
- Versions
- 2.6.0+dfsg-1
- Affected ranges
- ECOSYSTEM: (−∞, +∞)
No fix published