Skip to content
CVE PROGRAM SOURCE RECORD7.5 High

CVE-2026-21728

Tempo query limit results in unbounded memory allocation

Read JSON ↗CVE.org ↗
Status
Published
Published
Updated
Assigning organization
GRAFANA

Description

Tempo queries with large limits can cause large memory allocations which can impact the availability of the service, depending on its deployment strategy. Mitigation can be done by setting max_result_limit in the search config, e.g. to 262144 (2^18). Alternatively, automatically restart the service.

Affected products

Version statuses are supplied by the assigning organization. Consult the original record for detailed ranges and platform conditions.

Grafana Tempo

Default version status: unaffected

  • 1.3.0 to ≤ 2.8.3affected
  • 2.9.0 to ≤ 2.9.1affected
  • 2.10.0 to ≤ 2.10.1affected

Grafana Enterprise Traces (GET)

Default version status: unaffected

  • 1.0.0 to ≤ 2.8.7affected

References