The public dashboard query endpoint does not limit request body size before processing, allowing unauthenticated attackers to trigger excessive memory allocation by sending arbitrarily large JSON payloads. This can lead to denial of service through memory exhaustion. No valid dashboard access token or authentication is required to exploit this vulnerability.
| Product | Vendor Advisory | Solution File | Added | Published |
|---|---|---|---|---|
| Alma_linux | — | Upgrade grafana-selinuxUpgrade grafana | Oct 11, 2026 | Aug 12, 2026 |
| Alpine Linux | — | Upgrade grafana | Jun 23, 2026 | Jun 22, 2026 |
| Redhat_linux | — | Upgrade grafana-debuginfoUpgrade grafanaUpgrade grafana-debugsourceUpgrade grafana-selinux | Sep 15, 2026 | Jun 22, 2026 |
| Rocky_linux | — | Upgrade grafana-debugsourceUpgrade grafanaUpgrade grafana-selinuxUpgrade grafana-debuginfo | Sep 18, 2026 | Sep 16, 2026 |
With curated Threat Intelligence, you can see which vulnerabilities truly put you at risk, prioritize what matters most, and act before attackers do.
Explore Intelligence Hub