BIT-grafana-2026-33374

See a problem?

Import Source

https://github.com/bitnami/vulndb/tree/main/data/grafana/BIT-grafana-2026-33374.json

JSON Data

https://api.osv.dev/v1/vulns/BIT-grafana-2026-33374

Aliases

CVE-2026-33374

Published

2026-10-20T08:44:57Z

Modified

2026-10-20T10:30:04Z

Summary

Unbounded memory allocation in the Prometheus rule conversion API

Details

The Prometheus rule conversion API endpoints in Grafana do not limit request body size, allowing authenticated users to trigger unbounded memory allocations that can crash the server through out-of-memory conditions.

Database specific

{
    "cpes":  [
        "cpe:2.3:a:grafana:grafana:*:*:*:*:enterprise:*:*:*",
        "cpe:2.3:a:grafana:grafana:*:*:*:*:*:go:*:*",
        "cpe:2.3:a:grafana:grafana:*:*:*:*:enterprise:go:*:*"
    ],
    "severity":  "Medium"
}

References

Affected packages

Bitnami / grafana

Package

Name: grafana
Purl: pkg:bitnami/grafana

Severity

6.5 (Medium) CVSS_V3 - CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H CVSS Calculator

Affected ranges

Type: SEMVER
Events: Introduced

12.0.0

Fixed

12.4.13

Introduced

13.0.0

Fixed

13.0.11

Introduced

13.1.0

Fixed

13.1.8

Introduced

13.2.0

Fixed

13.2.4

Database specific

source

"https://github.com/bitnami/vulndb/tree/main/data/grafana/BIT-grafana-2026-33374.json"