CVE-2026-21720

{"dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": {"cveId": "CVE-2026-21720", "assignerOrgId": "57da9224-a3e2-4646-9d0e-c4dc2e05e7da", "state": "PUBLISHED", "assignerShortName": "GRAFANA", "dateReserved": "2026-01-05T09:26:06.214Z", "datePublished": "2026-01-27T09:07:04.758Z", "dateUpdated": "2026-08-27T17:22:47.419Z"}, "containers": {"cna": {"providerMetadata": {"orgId": "57da9224-a3e2-4646-9d0e-c4dc2e05e7da", "shortName": "GRAFANA", "dateUpdated": "2026-08-27T17:22:47.419Z"}, "datePublic": "2026-01-27T09:03:09.893Z", "title": "Unauthenticated DoS: avatar cache leaks goroutines when /avatar/:hash requests time out", "descriptions": [{"lang": "en", "value": "Every uncached /avatar/:hash request spawns a goroutine that refreshes the Gravatar image. If the refresh sits in the 10-slot worker queue longer than three seconds, the handler times out and stops listening for the result, so that goroutine blocks forever trying to send on an unbuffered channel. Sustained traffic with random hashes keeps tripping this timeout, so goroutine count grows linearly, eventually exhausting memory and causing Grafana to crash on some systems.", "supportingMedia": [{"type": "text/markdown", "value": "Every uncached /avatar/:hash request spawns a goroutine that refreshes the Gravatar image. If the refresh sits in the 10-slot worker queue longer than three seconds, the handler times out and stops listening for the result, so that goroutine blocks forever trying to send on an unbuffered channel. Sustained traffic with random hashes keeps tripping this timeout, so goroutine count grows linearly, eventually exhausting memory and causing Grafana to crash on some systems."}]}], "affected": [{"vendor": "Grafana", "product": "grafana/grafana-enterprise", "defaultStatus": "unaffected", "versions": [{"version": "3.0.0", "status": "affected", "versionType": "semver", "lessThan": "11.6.9"}]}, {"vendor": "Grafana", "product": "grafana/grafana-enterprise", "defaultStatus": "unaffected", "versions": [{"version": "3.0.0", "status": "affected", "versionType": "semver", "lessThan": "12.0.8"}]}, {"vendor": "Grafana", "product": "grafana/grafana-enterprise", "defaultStatus": "unaffected", "versions": [{"version": "3.0.0", "status": "affected", "versionType": "semver", "lessThan": "12.1.5"}]}, {"vendor": "Grafana", "product": "grafana/grafana", "defaultStatus": "unaffected", "versions": [{"version": "3.0.0", "status": "affected", "versionType": "semver", "lessThan": "11.6.9"}]}, {"vendor": "Grafana", "product": "grafana/grafana", "defaultStatus": "unaffected", "versions": [{"version": "3.0.0", "status": "affected", "versionType": "semver", "lessThan": "12.0.8"}]}, {"vendor": "Grafana", "product": "grafana/grafana", "defaultStatus": "unaffected", "versions": [{"version": "3.0.0", "status": "affected", "versionType": "semver", "lessThan": "12.1.5"}]}, {"vendor": "Grafana", "product": "grafana/grafana-enterprise", "defaultStatus": "unaffected", "versions": [{"version": "3.0.0", "status": "affected", "versionType": "semver", "lessThan": "12.2.3"}]}, {"vendor": "Grafana", "product": "grafana/grafana", "defaultStatus": "unaffected", "versions": [{"version": "3.0.0", "status": "affected", "versionType": "semver", "lessThan": "12.2.3"}]}, {"vendor": "Grafana", "product": "grafana/grafana-enterprise", "defaultStatus": "unaffected", "versions": [{"version": "3.0.0", "status": "affected", "versionType": "semver", "lessThan": "12.3.1"}]}, {"vendor": "Grafana", "product": "grafana/grafana", "defaultStatus": "unaffected", "versions": [{"version": "3.0.0", "status": "affected", "versionType": "semver", "lessThan": "12.3.1"}]}], "references": [{"url": "https://grafana.com/security/security-advisories/cve-2026-21720", "tags": ["vendor-advisory"]}], "metrics": [{"cvssV3_1": {"version": "3.1", "baseScore": 7.5, "baseSeverity": "HIGH", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H"}}], "source": {"discovery": "BUG_BOUNTY"}, "x_generator": {"engine": "cvelib 1.8.0"}}, "adp": [{"problemTypes": [{"descriptions": [{"type": "CWE", "cweId": "CWE-400", "lang": "en", "description": "CWE-400 Uncontrolled Resource Consumption"}]}, {"descriptions": [{"type": "CWE", "cweId": "CWE-703", "lang": "en", "description": "CWE-703 Improper Check or Handling of Exceptional Conditions"}]}], "metrics": [{"other": {"type": "ssvc", "content": {"timestamp": "2026-01-27T14:28:02.795937Z", "id": "CVE-2026-21720", "options": [{"Exploitation": "none"}, {"Automatable": "yes"}, {"Technical Impact": "partial"}], "role": "CISA Coordinator", "version": "2.0.3"}}}], "title": "CISA ADP Vulnrichment", "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-01-27T14:29:08.671Z"}}, {"affected": [{"collectionURL": "https://access.redhat.com/downloads/content/package-browser/", "cpes": ["cpe:/a:redhat:ceph_storage:7"], "defaultStatus": "unaffected", "packageName": "rhceph/grafana-rhel9", "product": "Red Hat Ceph Storage 7", "vendor": "Red Hat"}, {"collectionURL": "https://access.redhat.com/downloads/content/package-browser/", "cpes": ["cpe:/a:redhat:ceph_storage:8"], "defaultStatus": "unaffected", "packageName": "rhceph/grafana-rhel9", "product": "Red Hat Ceph Storage 8", "vendor": "Red Hat"}, {"collectionURL": "https://access.redhat.com/downloads/content/package-browser/", "cpes": ["cpe:/o:redhat:enterprise_linux:10"], "defaultStatus": "unaffected", "packageName": "grafana", "product": "Red Hat Enterprise Linux 10", "vendor": "Red Hat"}, {"collectionURL": "https://access.redhat.com/downloads/content/package-browser/", "cpes": ["cpe:/o:redhat:enterprise_linux:8"], "defaultStatus": "unaffected", "packageName": "grafana", "product": "Red Hat Enterprise Linux 8", "vendor": "Red Hat"}, {"collectionURL": "https://access.redhat.com/downloads/content/package-browser/", "cpes": ["cpe:/o:redhat:enterprise_linux:9"], "defaultStatus": "unaffected", "packageName": "grafana", "product": "Red Hat Enterprise Linux 9", "vendor": "Red Hat"}], "datePublic": "2026-01-27T09:07:04.758Z", "descriptions": [{"lang": "en", "value": "A flaw was found in Grafana. A remote attacker can exploit this vulnerability by sending a sustained volume of uncached /avatar/:hash requests. This action causes the system to create and block goroutines, which are lightweight concurrent functions, leading to a continuous increase in memory usage. Over time, this resource exhaustion can cause Grafana to crash, resulting in a Denial of Service (DoS)."}], "metrics": [{"other": {"content": {"namespace": "https://access.redhat.com/security/updates/classification/", "value": "Important"}, "type": "Red Hat severity rating"}}, {"cvssV3_1": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "HIGH", "baseScore": 7.5, "baseSeverity": "HIGH", "confidentialityImpact": "NONE", "integrityImpact": "NONE", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "version": "3.1"}, "format": "CVSS"}], "problemTypes": [{"descriptions": [{"cweId": "CWE-772", "description": "Missing Release of Resource after Effective Lifetime", "lang": "en", "type": "CWE"}]}], "references": [{"tags": ["vdb-entry", "x_refsource_REDHAT"], "url": "https://access.redhat.com/security/cve/CVE-2026-21720"}, {"name": "RHBZ#2433226", "tags": ["issue-tracking", "x_refsource_REDHAT"], "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2433226"}, {"tags": ["x_sadp-csaf-vex"], "url": "https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-21720.json"}], "timeline": [{"lang": "en", "time": "2026-01-27T10:01:10.677Z", "value": "Reported to Red Hat."}, {"lang": "en", "time": "2026-01-27T09:07:04.758Z", "value": "Made public."}], "title": "grafana: Grafana: Denial of Service via resource exhaustion from avatar requests", "x_adpType": "supplier", "x_generator": {"engine": "sadp-cli 1.0.0"}, "providerMetadata": {"orgId": "0b0ca135-0b70-47e7-9f44-1890c2a1c46c", "shortName": "redhat-SADP", "dateUpdated": "2026-07-15T01:19:55.276Z"}}]}}

{"dataType": "CVE_RECORD", "containers": {"adp": [{"title": "grafana: Grafana: Denial of Service via resource exhaustion from avatar requests", "metrics": [{"other": {"type": "Red Hat severity rating", "content": {"value": "Important", "namespace": "https://access.redhat.com/security/updates/classification/"}}}, {"format": "CVSS", "cvssV3_1": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 7.5, "attackVector": "NETWORK", "baseSeverity": "HIGH", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "integrityImpact": "NONE", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "HIGH", "privilegesRequired": "NONE", "confidentialityImpact": "NONE"}}], "affected": [{"cpes": ["cpe:/a:redhat:ceph_storage:7"], "vendor": "Red Hat", "product": "Red Hat Ceph Storage 7", "packageName": "rhceph/grafana-rhel9", "collectionURL": "https://access.redhat.com/downloads/content/package-browser/", "defaultStatus": "unaffected"}, {"cpes": ["cpe:/a:redhat:ceph_storage:8"], "vendor": "Red Hat", "product": "Red Hat Ceph Storage 8", "packageName": "rhceph/grafana-rhel9", "collectionURL": "https://access.redhat.com/downloads/content/package-browser/", "defaultStatus": "unaffected"}, {"cpes": ["cpe:/o:redhat:enterprise_linux:10"], "vendor": "Red Hat", "product": "Red Hat Enterprise Linux 10", "packageName": "grafana", "collectionURL": "https://access.redhat.com/downloads/content/package-browser/", "defaultStatus": "unaffected"}, {"cpes": ["cpe:/o:redhat:enterprise_linux:8"], "vendor": "Red Hat", "product": "Red Hat Enterprise Linux 8", "packageName": "grafana", "collectionURL": "https://access.redhat.com/downloads/content/package-browser/", "defaultStatus": "unaffected"}, {"cpes": ["cpe:/o:redhat:enterprise_linux:9"], "vendor": "Red Hat", "product": "Red Hat Enterprise Linux 9", "packageName": "grafana", "collectionURL": "https://access.redhat.com/downloads/content/package-browser/", "defaultStatus": "unaffected"}], "timeline": [{"lang": "en", "time": "2026-01-27T10:01:10.677Z", "value": "Reported to Red Hat."}, {"lang": "en", "time": "2026-01-27T09:07:04.758Z", "value": "Made public."}], "x_adpType": "supplier", "datePublic": "2026-01-27T09:07:04.758Z", "references": [{"url": "https://access.redhat.com/security/cve/CVE-2026-21720", "tags": ["vdb-entry", "x_refsource_REDHAT"]}, {"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2433226", "name": "RHBZ#2433226", "tags": ["issue-tracking", "x_refsource_REDHAT"]}, {"url": "https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-21720.json", "tags": ["x_sadp-csaf-vex"]}], "x_generator": {"engine": "sadp-cli 1.0.0"}, "descriptions": [{"lang": "en", "value": "A flaw was found in Grafana. A remote attacker can exploit this vulnerability by sending a sustained volume of uncached /avatar/:hash requests. This action causes the system to create and block goroutines, which are lightweight concurrent functions, leading to a continuous increase in memory usage. Over time, this resource exhaustion can cause Grafana to crash, resulting in a Denial of Service (DoS)."}], "problemTypes": [{"descriptions": [{"lang": "en", "type": "CWE", "cweId": "CWE-772", "description": "Missing Release of Resource after Effective Lifetime"}]}], "providerMetadata": {"orgId": "0b0ca135-0b70-47e7-9f44-1890c2a1c46c", "shortName": "redhat-SADP", "dateUpdated": "2026-07-15T01:19:55.276Z"}}, {"title": "CISA ADP Vulnrichment", "metrics": [{"other": {"type": "ssvc", "content": {"id": "CVE-2026-21720", "role": "CISA Coordinator", "options": [{"Exploitation": "none"}, {"Automatable": "yes"}, {"Technical Impact": "partial"}], "version": "2.0.3", "timestamp": "2026-01-27T14:28:02.795937Z"}}}], "problemTypes": [{"descriptions": [{"lang": "en", "type": "CWE", "cweId": "CWE-400", "description": "CWE-400 Uncontrolled Resource Consumption"}]}, {"descriptions": [{"lang": "en", "type": "CWE", "cweId": "CWE-703", "description": "CWE-703 Improper Check or Handling of Exceptional Conditions"}]}], "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-01-27T14:27:05.963Z"}}], "cna": {"title": "Unauthenticated DoS: avatar cache leaks goroutines when /avatar/:hash requests time out", "source": {"discovery": "BUG_BOUNTY"}, "metrics": [{"cvssV3_1": {"version": "3.1", "baseScore": 7.5, "baseSeverity": "HIGH", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H"}}], "affected": [{"vendor": "Grafana", "product": "grafana/grafana-enterprise", "versions": [{"status": "affected", "version": "3.0.0", "lessThan": "11.6.9", "versionType": "semver"}], "defaultStatus": "unaffected"}, {"vendor": "Grafana", "product": "grafana/grafana-enterprise", "versions": [{"status": "affected", "version": "3.0.0", "lessThan": "12.0.8", "versionType": "semver"}], "defaultStatus": "unaffected"}, {"vendor": "Grafana", "product": "grafana/grafana-enterprise", "versions": [{"status": "affected", "version": "3.0.0", "lessThan": "12.1.5", "versionType": "semver"}], "defaultStatus": "unaffected"}, {"vendor": "Grafana", "product": "grafana/grafana", "versions": [{"status": "affected", "version": "3.0.0", "lessThan": "11.6.9", "versionType": "semver"}], "defaultStatus": "unaffected"}, {"vendor": "Grafana", "product": "grafana/grafana", "versions": [{"status": "affected", "version": "3.0.0", "lessThan": "12.0.8", "versionType": "semver"}], "defaultStatus": "unaffected"}, {"vendor": "Grafana", "product": "grafana/grafana", "versions": [{"status": "affected", "version": "3.0.0", "lessThan": "12.1.5", "versionType": "semver"}], "defaultStatus": "unaffected"}, {"vendor": "Grafana", "product": "grafana/grafana-enterprise", "versions": [{"status": "affected", "version": "3.0.0", "lessThan": "12.2.3", "versionType": "semver"}], "defaultStatus": "unaffected"}, {"vendor": "Grafana", "product": "grafana/grafana", "versions": [{"status": "affected", "version": "3.0.0", "lessThan": "12.2.3", "versionType": "semver"}], "defaultStatus": "unaffected"}, {"vendor": "Grafana", "product": "grafana/grafana-enterprise", "versions": [{"status": "affected", "version": "3.0.0", "lessThan": "12.3.1", "versionType": "semver"}], "defaultStatus": "unaffected"}, {"vendor": "Grafana", "product": "grafana/grafana", "versions": [{"status": "affected", "version": "3.0.0", "lessThan": "12.3.1", "versionType": "semver"}], "defaultStatus": "unaffected"}], "datePublic": "2026-01-27T09:03:09.893Z", "references": [{"url": "https://grafana.com/security/security-advisories/cve-2026-21720", "tags": ["vendor-advisory"]}], "x_generator": {"engine": "cvelib 1.8.0"}, "descriptions": [{"lang": "en", "value": "Every uncached /avatar/:hash request spawns a goroutine that refreshes the Gravatar image. If the refresh sits in the 10-slot worker queue longer than three seconds, the handler times out and stops listening for the result, so that goroutine blocks forever trying to send on an unbuffered channel. Sustained traffic with random hashes keeps tripping this timeout, so goroutine count grows linearly, eventually exhausting memory and causing Grafana to crash on some systems.", "supportingMedia": [{"type": "text/markdown", "value": "Every uncached /avatar/:hash request spawns a goroutine that refreshes the Gravatar image. If the refresh sits in the 10-slot worker queue longer than three seconds, the handler times out and stops listening for the result, so that goroutine blocks forever trying to send on an unbuffered channel. Sustained traffic with random hashes keeps tripping this timeout, so goroutine count grows linearly, eventually exhausting memory and causing Grafana to crash on some systems."}]}], "providerMetadata": {"orgId": "57da9224-a3e2-4646-9d0e-c4dc2e05e7da", "shortName": "GRAFANA", "dateUpdated": "2026-08-27T17:22:47.419Z"}}}, "cveMetadata": {"cveId": "CVE-2026-21720", "state": "PUBLISHED", "dateUpdated": "2026-08-27T17:22:47.419Z", "dateReserved": "2026-01-05T09:26:06.214Z", "assignerOrgId": "57da9224-a3e2-4646-9d0e-c4dc2e05e7da", "datePublished": "2026-01-27T09:07:04.758Z", "assignerShortName": "GRAFANA"}, "dataVersion": "5.2"}

{"affected": [{"affectedData": [{"defaultStatus": "unaffected", "product": "grafana/grafana-enterprise", "vendor": "Grafana", "versions": [{"lessThan": "11.6.9", "status": "affected", "version": "3.0.0", "versionType": "semver"}]}, {"defaultStatus": "unaffected", "product": "grafana/grafana-enterprise", "vendor": "Grafana", "versions": [{"lessThan": "12.0.8", "status": "affected", "version": "3.0.0", "versionType": "semver"}]}, {"defaultStatus": "unaffected", "product": "grafana/grafana-enterprise", "vendor": "Grafana", "versions": [{"lessThan": "12.1.5", "status": "affected", "version": "3.0.0", "versionType": "semver"}]}, {"defaultStatus": "unaffected", "product": "grafana/grafana", "vendor": "Grafana", "versions": [{"lessThan": "11.6.9", "status": "affected", "version": "3.0.0", "versionType": "semver"}]}, {"defaultStatus": "unaffected", "product": "grafana/grafana", "vendor": "Grafana", "versions": [{"lessThan": "12.0.8", "status": "affected", "version": "3.0.0", "versionType": "semver"}]}, {"defaultStatus": "unaffected", "product": "grafana/grafana", "vendor": "Grafana", "versions": [{"lessThan": "12.1.5", "status": "affected", "version": "3.0.0", "versionType": "semver"}]}, {"defaultStatus": "unaffected", "product": "grafana/grafana-enterprise", "vendor": "Grafana", "versions": [{"lessThan": "12.2.3", "status": "affected", "version": "3.0.0", "versionType": "semver"}]}, {"defaultStatus": "unaffected", "product": "grafana/grafana", "vendor": "Grafana", "versions": [{"lessThan": "12.2.3", "status": "affected", "version": "3.0.0", "versionType": "semver"}]}, {"defaultStatus": "unaffected", "product": "grafana/grafana-enterprise", "vendor": "Grafana", "versions": [{"lessThan": "12.3.1", "status": "affected", "version": "3.0.0", "versionType": "semver"}]}, {"defaultStatus": "unaffected", "product": "grafana/grafana", "vendor": "Grafana", "versions": [{"lessThan": "12.3.1", "status": "affected", "version": "3.0.0", "versionType": "semver"}]}], "source": "security@grafana.com"}, {"affectedData": [{"collectionURL": "https://access.redhat.com/downloads/content/package-browser/", "cpes": ["cpe:/a:redhat:ceph_storage:7"], "defaultStatus": "unaffected", "packageName": "rhceph/grafana-rhel9", "product": "Red Hat Ceph Storage 7", "vendor": "Red Hat"}, {"collectionURL": "https://access.redhat.com/downloads/content/package-browser/", "cpes": ["cpe:/a:redhat:ceph_storage:8"], "defaultStatus": "unaffected", "packageName": "rhceph/grafana-rhel9", "product": "Red Hat Ceph Storage 8", "vendor": "Red Hat"}, {"collectionURL": "https://access.redhat.com/downloads/content/package-browser/", "cpes": ["cpe:/o:redhat:enterprise_linux:10"], "defaultStatus": "unaffected", "packageName": "grafana", "product": "Red Hat Enterprise Linux 10", "vendor": "Red Hat"}, {"collectionURL": "https://access.redhat.com/downloads/content/package-browser/", "cpes": ["cpe:/o:redhat:enterprise_linux:8"], "defaultStatus": "unaffected", "packageName": "grafana", "product": "Red Hat Enterprise Linux 8", "vendor": "Red Hat"}, {"collectionURL": "https://access.redhat.com/downloads/content/package-browser/", "cpes": ["cpe:/o:redhat:enterprise_linux:9"], "defaultStatus": "unaffected", "packageName": "grafana", "product": "Red Hat Enterprise Linux 9", "vendor": "Red Hat"}], "source": "0b0ca135-0b70-47e7-9f44-1890c2a1c46c"}], "configurations": [{"nodes": [{"cpeMatch": [{"criteria": "cpe:2.3:a:grafana:grafana:*:*:*:*:-:*:*:*", "matchCriteriaId": "215EC0E7-BF4E-460F-893F-3D5E56692D65", "versionEndExcluding": "11.6.9", "versionStartIncluding": "3.0.0", "vulnerable": true}, {"criteria": "cpe:2.3:a:grafana:grafana:*:*:*:*:enterprise:*:*:*", "matchCriteriaId": "4D528EF4-2414-4A32-BA0E-16FA15EE1D52", "versionEndExcluding": "11.6.9", "versionStartIncluding": "3.0.0", "vulnerable": true}, {"criteria": "cpe:2.3:a:grafana:grafana:*:*:*:*:-:*:*:*", "matchCriteriaId": "C3E78D4A-A206-4BD4-BBE5-F8BE832B4A07", "versionEndExcluding": "12.0.8", "versionStartIncluding": "12.0.0", "vulnerable": true}, {"criteria": "cpe:2.3:a:grafana:grafana:*:*:*:*:enterprise:*:*:*", "matchCriteriaId": "C0821B6B-AC98-4A9D-973D-12E2063DF866", "versionEndExcluding": "12.0.8", "versionStartIncluding": "12.0.0", "vulnerable": true}, {"criteria": "cpe:2.3:a:grafana:grafana:*:*:*:*:-:*:*:*", "matchCriteriaId": "993757EB-FCCD-4B3B-B23A-00EA8B1AFF52", "versionEndExcluding": "12.1.5", "versionStartIncluding": "12.1.0", "vulnerable": true}, {"criteria": "cpe:2.3:a:grafana:grafana:*:*:*:*:enterprise:*:*:*", "matchCriteriaId": "FB947690-25AC-4597-80B3-9034CE94B8C7", "versionEndExcluding": "12.1.5", "versionStartIncluding": "12.1.0", "vulnerable": true}, {"criteria": "cpe:2.3:a:grafana:grafana:*:*:*:*:-:*:*:*", "matchCriteriaId": "A87029A0-871D-4130-A240-7A64990573F5", "versionEndExcluding": "12.2.3", "versionStartIncluding": "12.2.0", "vulnerable": true}, {"criteria": "cpe:2.3:a:grafana:grafana:*:*:*:*:enterprise:*:*:*", "matchCriteriaId": "B3E99C8B-08A8-4672-8ED2-E8CE2F3DCD4A", "versionEndExcluding": "12.2.3", "versionStartIncluding": "12.2.0", "vulnerable": true}, {"criteria": "cpe:2.3:a:grafana:grafana:12.3.0:*:*:*:-:*:*:*", "matchCriteriaId": "9BE4EE19-92B3-4B1D-97BE-76194B38DA2A", "vulnerable": true}, {"criteria": "cpe:2.3:a:grafana:grafana:12.3.0:*:*:*:enterprise:*:*:*", "matchCriteriaId": "EB9EC106-6F33-4834-B59D-6633BB83B6A5", "vulnerable": true}], "negate": false, "operator": "OR"}]}], "cveTags": [], "descriptions": [{"lang": "en", "value": "Every uncached /avatar/:hash request spawns a goroutine that refreshes the Gravatar image. If the refresh sits in the 10-slot worker queue longer than three seconds, the handler times out and stops listening for the result, so that goroutine blocks forever trying to send on an unbuffered channel. Sustained traffic with random hashes keeps tripping this timeout, so goroutine count grows linearly, eventually exhausting memory and causing Grafana to crash on some systems."}, {"lang": "es", "value": "Cada solicitud sin cach\u00e9 a /avatar/:hash lanza una goroutine que actualiza la imagen de Gravatar. Si la actualizaci\u00f3n permanece en la cola de trabajadores de 10 ranuras por m\u00e1s de tres segundos, el manejador agota el tiempo de espera y deja de escuchar el resultado, de modo que esa goroutine se bloquea para siempre intentando enviar en un canal sin b\u00fafer. El tr\u00e1fico sostenido con hashes aleatorios sigue activando este tiempo de espera, por lo que el recuento de goroutines crece linealmente, agotando la memoria con el tiempo y provocando que Grafana falle en algunos sistemas."}], "id": "CVE-2026-21720", "lastModified": "2026-07-15T02:18:30.797", "metrics": {"cvssMetricV31": [{"cvssData": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "HIGH", "baseScore": 7.5, "baseSeverity": "HIGH", "confidentialityImpact": "NONE", "integrityImpact": "NONE", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "version": "3.1"}, "exploitabilityScore": 3.9, "impactScore": 3.6, "source": "security@grafana.com", "type": "Secondary"}, {"cvssData": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "HIGH", "baseScore": 7.5, "baseSeverity": "HIGH", "confidentialityImpact": "NONE", "integrityImpact": "NONE", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "version": "3.1"}, "exploitabilityScore": 3.9, "impactScore": 3.6, "source": "0b0ca135-0b70-47e7-9f44-1890c2a1c46c", "type": "Secondary"}], "ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2026-21720", "options": [{"exploitation": "none"}, {"automatable": "yes"}, {"technicalImpact": "partial"}], "role": "CISA Coordinator", "timestamp": "2026-01-27T14:28:02.795937Z", "version": "2.0.3"}}]}, "published": "2026-01-27T09:15:48.490", "references": [{"source": "security@grafana.com", "tags": ["Broken Link"], "url": "https://grafana.com/security/security-advisories/cve-2026-21720"}, {"source": "0b0ca135-0b70-47e7-9f44-1890c2a1c46c", "url": "https://access.redhat.com/security/cve/CVE-2026-21720"}, {"source": "0b0ca135-0b70-47e7-9f44-1890c2a1c46c", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2433226"}, {"source": "0b0ca135-0b70-47e7-9f44-1890c2a1c46c", "url": "https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-21720.json"}], "sourceIdentifier": "security@grafana.com", "vulnStatus": "Modified", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-400"}, {"lang": "en", "value": "CWE-703"}], "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "type": "Secondary"}, {"description": [{"lang": "en", "value": "CWE-772"}], "source": "0b0ca135-0b70-47e7-9f44-1890c2a1c46c", "type": "Secondary"}]}

{"bugzilla": {"description": "grafana: Grafana: Denial of Service via resource exhaustion from avatar requests", "id": "2433226", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2433226"}, "csaw": false, "cvss3": {"cvss3_base_score": "7.5", "cvss3_scoring_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "status": "draft"}, "cwe": "CWE-772", "details": ["Every uncached /avatar/:hash request spawns a goroutine that refreshes the Gravatar image. If the refresh sits in the 10-slot worker queue longer than three seconds, the handler times out and stops listening for the result, so that goroutine blocks forever trying to send on an unbuffered channel. Sustained traffic with random hashes keeps tripping this timeout, so goroutine count grows linearly, eventually exhausting memory and causing Grafana to crash on some systems.", "A flaw was found in Grafana. A remote attacker can exploit this vulnerability by sending a sustained volume of uncached /avatar/:hash requests. This action causes the system to create and block goroutines, which are lightweight concurrent functions, leading to a continuous increase in memory usage. Over time, this resource exhaustion can cause Grafana to crash, resulting in a Denial of Service (DoS)."], "mitigation": {"lang": "en:us", "value": "To mitigate this issue, disable Gravatar support in the Grafana configuration. Edit the `grafana.ini` file and set `allow_gravatar = false` under the `[users]` section. After modifying the configuration, restart the Grafana service for the changes to take effect. This action will prevent user avatars from being displayed."}, "name": "CVE-2026-21720", "package_state": [{"cpe": "cpe:/a:redhat:ceph_storage:7", "fix_state": "Not affected", "package_name": "rhceph/grafana-rhel9", "product_name": "Red Hat Ceph Storage 7"}, {"cpe": "cpe:/a:redhat:ceph_storage:8", "fix_state": "Not affected", "package_name": "rhceph/grafana-rhel9", "product_name": "Red Hat Ceph Storage 8"}, {"cpe": "cpe:/o:redhat:enterprise_linux:10", "fix_state": "Not affected", "package_name": "grafana", "product_name": "Red Hat Enterprise Linux 10"}, {"cpe": "cpe:/o:redhat:enterprise_linux:8", "fix_state": "Not affected", "package_name": "grafana", "product_name": "Red Hat Enterprise Linux 8"}, {"cpe": "cpe:/o:redhat:enterprise_linux:9", "fix_state": "Not affected", "package_name": "grafana", "product_name": "Red Hat Enterprise Linux 9"}], "public_date": "2026-01-27T09:07:04Z", "references": ["https://www.cve.org/CVERecord?id=CVE-2026-21720\nhttps://nvd.nist.gov/vuln/detail/CVE-2026-21720\nhttps://grafana.com/security/security-advisories/CVE-2026-21720"], "statement": "This IMPORTANT denial of service vulnerability in Grafana allows an unauthenticated attacker to exhaust system resources. By sending sustained requests to the `/avatar/:hash` endpoint, goroutines leak due to timed-out Gravatar image refreshes, leading to memory exhaustion and potential Grafana service crashes. This affects Grafana instances shipped with Red Hat Ceph Storage, Red Hat Enterprise Linux, and Red Hat In-Vehicle OS.", "threat_severity": "Important"}

{"analysis": {"en": {"generated_at": "2026-04-15T17:36:27.338581+00:00", "value": {"mitigation_remediation": ["Upgrade Grafana to the patched release identified in the Grafana security advisory, such as the latest 12.3.x update.", "If an upgrade cannot be performed immediately, block or rate limit unauthenticated access to the /avatar/:hash endpoint, or disable Avatar functionality until a patch is applied.", "Continuously monitor goroutine counts and memory usage for abnormal growth, and restart Grafana services promptly when resource limits are reached."], "summary": {"action": "Immediate Patch", "impact": "Denial of Service via resource exhaustion"}, "threat_synthesis": {"affected_systems": "Grafana\u2019s open\u2011source Grafana product and its Grafana Enterprise edition are affected. The issue is present in at least version 12.3.0, as indicated by the CPE strings, and applies to all subsequent releases until a patch is applied.", "description_and_impact": "Every uncached /avatar/:hash request spawns a goroutine that attempts to refresh the Gravatar image. If the request times out while queued, the goroutine blocks forever on an unbuffered channel, leaking goroutine resources. Sustained traffic with random hashes repeatedly triggers this scenario, causing the goroutine count to grow until memory is exhausted and Grafana terminates. The flaw permits an unauthenticated attacker to exhaust server resources, leading to application crashes.", "risk_and_exploitability": "With a CVSS score of 7.5, the vulnerability is of medium\u2011high severity. The EPSS score (<1%) suggests a low probability of exploitation at present, and the flaw has not yet been recorded in CISA\u2019s KEV catalog. Attackers can exploit it by sending unauthenticated /avatar/:hash requests from any host that can reach Grafana, potentially from externally exposed services. Successful exploitation leads to resource exhaustion and denial of service."}}}}, "created": "2026-01-27T20:17:18.248685+00:00", "updated": "2026-04-15T18:00:15.541370+00:00", "vendors": ["grafana", "grafana$PRODUCT$grafana", "grafana$PRODUCT$grafana_enterprise"]}