CVE-2026-33382

{"dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": {"cveId": "CVE-2026-33382", "assignerOrgId": "57da9224-a3e2-4646-9d0e-c4dc2e05e7da", "state": "PUBLISHED", "assignerShortName": "GRAFANA", "dateReserved": "2026-03-19T07:55:06.978Z", "datePublished": "2026-07-10T14:58:23.329Z", "dateUpdated": "2026-08-27T17:22:28.355Z"}, "containers": {"cna": {"providerMetadata": {"orgId": "57da9224-a3e2-4646-9d0e-c4dc2e05e7da", "shortName": "GRAFANA", "dateUpdated": "2026-08-27T17:22:28.355Z"}, "datePublic": "2026-06-09T00:00:00.000Z", "title": "Denial of service via unbounded request body size", "descriptions": [{"lang": "en", "value": "Several Grafana API endpoints, some of them unauthenticated, do not limit the size of the request body before processing it. An attacker can send very large payloads that force excessive memory allocation, potentially exhausting memory and causing a denial of service."}], "affected": [{"vendor": "Grafana", "product": "Grafana OSS", "defaultStatus": "unaffected", "versions": [{"version": "11.6.0", "status": "affected", "versionType": "semver", "lessThanOrEqual": "11.6.14"}, {"version": "12.2.0", "status": "affected", "versionType": "semver", "lessThanOrEqual": "12.2.8"}, {"version": "12.3.0", "status": "affected", "versionType": "semver", "lessThanOrEqual": "12.3.6"}, {"version": "12.4.0", "status": "affected", "versionType": "semver", "lessThanOrEqual": "12.4.3"}, {"version": "13.0.0", "status": "affected", "versionType": "semver", "lessThanOrEqual": "13.0.1"}]}], "references": [{"url": "https://grafana.com/security/security-advisories/cve-2026-33382", "tags": ["vendor-advisory"]}], "metrics": [{"cvssV3_1": {"version": "3.1", "baseScore": 7.5, "baseSeverity": "HIGH", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H"}}], "source": {"discovery": "INTERNAL_FINDING"}, "problemTypes": [{"descriptions": [{"lang": "en", "description": "CWE-400", "cweId": "CWE-400", "type": "CWE"}]}], "x_generator": {"engine": "cvelib 1.8.0"}}, "adp": [{"metrics": [{"other": {"type": "ssvc", "content": {"timestamp": "2026-07-10T15:59:38.846803Z", "id": "CVE-2026-33382", "options": [{"Exploitation": "none"}, {"Automatable": "yes"}, {"Technical Impact": "partial"}], "role": "CISA Coordinator", "version": "2.0.3"}}}], "title": "CISA ADP Vulnrichment", "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-07-10T15:59:43.742Z"}}]}}

{"dataType": "CVE_RECORD", "containers": {"adp": [{"title": "CISA ADP Vulnrichment", "metrics": [{"other": {"type": "ssvc", "content": {"id": "CVE-2026-33382", "role": "CISA Coordinator", "options": [{"Exploitation": "none"}, {"Automatable": "yes"}, {"Technical Impact": "partial"}], "version": "2.0.3", "timestamp": "2026-07-10T15:59:38.846803Z"}}}], "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-07-10T15:59:40.873Z"}}], "cna": {"title": "Denial of service via unbounded request body size", "source": {"discovery": "INTERNAL_FINDING"}, "metrics": [{"cvssV3_1": {"version": "3.1", "baseScore": 7.5, "baseSeverity": "HIGH", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H"}}], "affected": [{"vendor": "Grafana", "product": "Grafana OSS", "versions": [{"status": "affected", "version": "11.6.0", "versionType": "semver", "lessThanOrEqual": "11.6.14"}, {"status": "affected", "version": "12.2.0", "versionType": "semver", "lessThanOrEqual": "12.2.8"}, {"status": "affected", "version": "12.3.0", "versionType": "semver", "lessThanOrEqual": "12.3.6"}, {"status": "affected", "version": "12.4.0", "versionType": "semver", "lessThanOrEqual": "12.4.3"}, {"status": "affected", "version": "13.0.0", "versionType": "semver", "lessThanOrEqual": "13.0.1"}], "defaultStatus": "unaffected"}], "datePublic": "2026-06-09T00:00:00.000Z", "references": [{"url": "https://grafana.com/security/security-advisories/cve-2026-33382", "tags": ["vendor-advisory"]}], "x_generator": {"engine": "cvelib 1.8.0"}, "descriptions": [{"lang": "en", "value": "Several Grafana API endpoints, some of them unauthenticated, do not limit the size of the request body before processing it. An attacker can send very large payloads that force excessive memory allocation, potentially exhausting memory and causing a denial of service."}], "problemTypes": [{"descriptions": [{"lang": "en", "type": "CWE", "cweId": "CWE-400", "description": "CWE-400"}]}], "providerMetadata": {"orgId": "57da9224-a3e2-4646-9d0e-c4dc2e05e7da", "shortName": "GRAFANA", "dateUpdated": "2026-08-27T17:22:28.355Z"}}}, "cveMetadata": {"cveId": "CVE-2026-33382", "state": "PUBLISHED", "dateUpdated": "2026-08-27T17:22:28.355Z", "dateReserved": "2026-03-19T07:55:06.978Z", "assignerOrgId": "57da9224-a3e2-4646-9d0e-c4dc2e05e7da", "datePublished": "2026-07-10T14:58:23.329Z", "assignerShortName": "GRAFANA"}, "dataVersion": "5.2"}

{"affected": [{"affectedData": [{"defaultStatus": "unaffected", "product": "Grafana OSS", "vendor": "Grafana", "versions": [{"lessThanOrEqual": "11.6.14", "status": "affected", "version": "11.6.0", "versionType": "semver"}, {"lessThanOrEqual": "12.2.8", "status": "affected", "version": "12.2.0", "versionType": "semver"}, {"lessThanOrEqual": "12.3.6", "status": "affected", "version": "12.3.0", "versionType": "semver"}, {"lessThanOrEqual": "12.4.3", "status": "affected", "version": "12.4.0", "versionType": "semver"}, {"lessThanOrEqual": "13.0.1", "status": "affected", "version": "13.0.0", "versionType": "semver"}]}], "source": "security@grafana.com"}], "configurations": [{"nodes": [{"cpeMatch": [{"criteria": "cpe:2.3:a:grafana:grafana:*:*:*:*:-:*:*:*", "matchCriteriaId": "B154BC07-0914-4E25-9D84-FB64205493F7", "versionEndExcluding": "11.6.15", "versionStartIncluding": "11.6.0", "vulnerable": true}, {"criteria": "cpe:2.3:a:grafana:grafana:*:*:*:*:-:*:*:*", "matchCriteriaId": "052CFAA8-0386-43DF-869A-643997178E8D", "versionEndExcluding": "12.2.9", "versionStartIncluding": "12.2.0", "vulnerable": true}, {"criteria": "cpe:2.3:a:grafana:grafana:*:*:*:*:-:*:*:*", "matchCriteriaId": "C77AA4CC-A590-4948-A010-5A1154502E47", "versionEndExcluding": "12.3.7", "versionStartIncluding": "12.3.0", "vulnerable": true}, {"criteria": "cpe:2.3:a:grafana:grafana:*:*:*:*:-:*:*:*", "matchCriteriaId": "F820291A-C1C6-4DBC-8064-6133F16547C4", "versionEndExcluding": "12.4.4", "versionStartIncluding": "12.4.0", "vulnerable": true}, {"criteria": "cpe:2.3:a:grafana:grafana:*:*:*:*:-:*:*:*", "matchCriteriaId": "643002A3-545F-4605-AAAF-EF55C5B14392", "versionEndExcluding": "13.0.2", "versionStartIncluding": "13.0.0", "vulnerable": true}], "negate": false, "operator": "OR"}]}], "cveTags": [], "descriptions": [{"lang": "en", "value": "Several Grafana API endpoints, some of them unauthenticated, do not limit the size of the request body before processing it. An attacker can send very large payloads that force excessive memory allocation, potentially exhausting memory and causing a denial of service."}, {"lang": "es", "value": "Varios puntos finales de la API de Grafana, algunos de ellos no autenticados, no limitan el tama\u00f1o del cuerpo de la solicitud antes de procesarlo. Un atacante puede enviar cargas \u00fatiles muy grandes que fuerzan una asignaci\u00f3n excesiva de memoria, agotando potencialmente la memoria y causando una denegaci\u00f3n de servicio."}], "id": "CVE-2026-33382", "lastModified": "2026-10-25T15:10:00.147", "metrics": {"cvssMetricV31": [{"cvssData": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "HIGH", "baseScore": 7.5, "baseSeverity": "HIGH", "confidentialityImpact": "NONE", "integrityImpact": "NONE", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "version": "3.1"}, "exploitabilityScore": 3.9, "impactScore": 3.6, "source": "security@grafana.com", "type": "Secondary"}], "ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2026-33382", "options": [{"exploitation": "none"}, {"automatable": "yes"}, {"technicalImpact": "partial"}], "role": "CISA Coordinator", "timestamp": "2026-07-10T15:59:38.846803Z", "version": "2.0.3"}}]}, "published": "2026-07-10T16:16:29.130", "references": [{"source": "security@grafana.com", "tags": ["Vendor Advisory"], "url": "https://grafana.com/security/security-advisories/cve-2026-33382"}], "sourceIdentifier": "security@grafana.com", "vulnStatus": "Analyzed", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-400"}], "source": "security@grafana.com", "type": "Secondary"}]}

{"bugzilla": {"description": "grafana: Grafana: Denial of Service via excessive memory allocation from large API request payloads", "id": "2499062", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2499062"}, "csaw": false, "cvss3": {"cvss3_base_score": "5.3", "cvss3_scoring_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L", "status": "draft"}, "cwe": "CWE-770", "details": ["Several Grafana API endpoints, some of them unauthenticated, do not limit the size of the request body before processing it. An attacker can send very large payloads that force excessive memory allocation, potentially exhausting memory and causing a denial of service.", "A flaw in Grafana's API endpoints allows remote attackers to send excessively large request bodies without authentication. This exhausts server memory, resulting in a complete denial of service (DoS)."], "mitigation": {"lang": "en:us", "value": "Deploy a reverse proxy or API gateway (e.g., Nginx) in front of Grafana configured to strictly limit the maximum HTTP request body size, dropping oversized payloads before they reach the backend. As a defense-in-depth measure, restrict network access to trusted internal clients via firewall rules. Note: Applying these proxy and network changes may require a service reload, causing a temporary interruption."}, "name": "CVE-2026-33382", "package_state": [{"cpe": "cpe:/a:redhat:multicluster_globalhub", "fix_state": "Not affected", "package_name": "multicluster-globalhub/multicluster-globalhub-grafana-rhel9", "product_name": "Multicluster Global Hub"}, {"cpe": "cpe:/a:redhat:acm:2", "fix_state": "Not affected", "package_name": "rhacm2/acm-grafana-rhel9", "product_name": "Red Hat Advanced Cluster Management for Kubernetes 2"}, {"cpe": "cpe:/a:redhat:ceph_storage:5", "fix_state": "Not affected", "package_name": "rhceph/rhceph-5-dashboard-rhel8", "product_name": "Red Hat Ceph Storage 5"}, {"cpe": "cpe:/a:redhat:ceph_storage:6", "fix_state": "Not affected", "package_name": "rhceph/rhceph-6-dashboard-rhel9", "product_name": "Red Hat Ceph Storage 6"}, {"cpe": "cpe:/a:redhat:ceph_storage:7", "fix_state": "Not affected", "package_name": "rhceph/grafana-rhel9", "product_name": "Red Hat Ceph Storage 7"}, {"cpe": "cpe:/a:redhat:ceph_storage:8", "fix_state": "Not affected", "package_name": "rhceph/grafana-rhel9", "product_name": "Red Hat Ceph Storage 8"}, {"cpe": "cpe:/a:redhat:ceph_storage:9", "fix_state": "Fix deferred", "package_name": "rhceph/grafana-rhel10", "product_name": "Red Hat Ceph Storage 9"}, {"cpe": "cpe:/o:redhat:enterprise_linux:10", "fix_state": "Affected", "package_name": "grafana", "product_name": "Red Hat Enterprise Linux 10"}, {"cpe": "cpe:/o:redhat:enterprise_linux:8", "fix_state": "Not affected", "package_name": "grafana", "product_name": "Red Hat Enterprise Linux 8"}, {"cpe": "cpe:/o:redhat:enterprise_linux:9", "fix_state": "Not affected", "package_name": "grafana", "product_name": "Red Hat Enterprise Linux 9"}], "public_date": "2026-07-10T14:58:23Z", "references": ["https://www.cve.org/CVERecord?id=CVE-2026-33382\nhttps://nvd.nist.gov/vuln/detail/CVE-2026-33382\nhttps://grafana.com/security/security-advisories/cve-2026-33382"], "statement": "Moderate: This denial of service vulnerability in Grafana stems from a lack of request body size limits on certain API endpoints, some of which are unauthenticated. Exploitation by a remote attacker sending large payloads can exhaust system memory, leading to service unavailability. The impact is assessed as Moderate because it primarily affects the availability of the Grafana application rather than compromising data or executing arbitrary code.", "threat_severity": "Moderate"}

{"affected": [{"configurations": [{"platform": null, "status": "affected", "versions": {"scheme": "semver", "value": "[11.6.0,11.6.14]"}}, {"platform": null, "status": "affected", "versions": {"scheme": "semver", "value": "[12.2.0,12.2.8]"}}, {"platform": null, "status": "affected", "versions": {"scheme": "semver", "value": "[12.3.0,12.3.6]"}}, {"platform": null, "status": "affected", "versions": {"scheme": "semver", "value": "[12.4.0,12.4.3]"}}, {"platform": null, "status": "affected", "versions": {"scheme": "semver", "value": "[13.0.0,13.0.1]"}}], "enrichment": {"confidence": 88.0, "confidence_source": "matching", "scores": [{"score": 88.0, "source": "matching"}]}, "original": {"product": "Grafana OSS", "source": "cna", "vendor": "Grafana"}, "product": "grafana", "vendor": "grafana"}], "created": "2026-07-11T11:00:06.124509+00:00", "updated": "2026-07-31T13:15:03.686365+00:00", "vendors": ["grafana", "grafana$PRODUCT$grafana"]}