7.5

CVE-2026-42127

Grafana pre-auth DoS through arbitrarily large input to public dashboard query handler

The public dashboard query endpoint does not limit request body size before processing, allowing unauthenticated attackers to trigger excessive memory allocation by sending arbitrarily large JSON payloads. This can lead to denial of service through memory exhaustion. No valid dashboard access token or authentication is required to exploit this vulnerability.
Daten sind bereitgestellt durch National Vulnerability Database (NVD)
Grafana ≫ Grafana SwEditionenterprise Version <= 11.6.14
Grafana ≫ Grafana SwEditionenterprise Version >= 12.2.0 <= 12.2.8
Grafana ≫ Grafana SwEditionenterprise Version >= 12.3.0 <= 12.3.6
Grafana ≫ Grafana SwEditionenterprise Version >= 12.4.0 <= 12.4.3
Grafana ≫ Grafana SwEditionenterprise Version >= 13.0.0 <= 13.0.1
Zu dieser CVE wurde keine Warnung gefunden.
EPSS Metriken
Typ Quelle Score Percentile
EPSS FIRST.org 0.43% 0.344
CVSS Metriken
Quelle Base Score Exploit Score Impact Score Vector String
security@grafana.com 7.5 3.9 3.6
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
CWE-770 Allocation of Resources Without Limits or Throttling

The product allocates a reusable resource or group of resources on behalf of an actor without imposing any intended restrictions on the size or number of resources that can be allocated.

https://grafana.com/security/security-advisories/cve-2026-42127
Broken Link