BIT-grafana-2026-33382

See a problem?
Import Source
https://github.com/bitnami/vulndb/tree/main/data/grafana/BIT-grafana-2026-33382.json
JSON Data
https://api.osv.dev/v1/vulns/BIT-grafana-2026-33382
Aliases
Published
2026-07-14T08:45:29Z
Modified
2026-09-08T08:47:51Z
Summary
Denial of service via unbounded request body size
Details

Several Grafana API endpoints, some of them unauthenticated, do not limit the size of the request body before processing it. An attacker can send very large payloads that force excessive memory allocation, potentially exhausting memory and causing a denial of service.

Database specific 
{
    "cpes":  [
        "cpe:2.3:a:grafana:grafana:*:*:*:*:-:*:*:*"
    ],
    "severity":  "High"
}
References

Affected packages

Bitnami / grafana

Package

Name
grafana
Purl
pkg:bitnami/grafana

Severity

  • 7.5 (High) CVSS_V3 - CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H CVSS Calculator

Affected ranges

Type
SEMVER
Events
Introduced
11.6.0
Fixed
11.6.15
Introduced
12.2.0
Fixed
12.2.9
Introduced
12.3.0
Fixed
12.3.7
Introduced
12.4.0
Fixed
12.4.4
Introduced
13.0.0
Fixed
13.0.2

Database specific

source 
"https://github.com/bitnami/vulndb/tree/main/data/grafana/BIT-grafana-2026-33382.json"