Description
A request to the Grafana plugin resources endpoint can cause unbounded memory allocation by reading the entire request body into memory. An authenticated user can exploit this to trigger an out-of-memory condition, potentially causing a denial of service.
Affected products
Version statuses are supplied by the assigning organization. Consult the original record for detailed ranges and platform conditions.
Grafana Grafana OSS
Default version status: unaffected
6.7.0 to ≤ 11.6.14affected11.6.14 to < 11.6.14+security-04affected12.0.0 to ≤ 12.2.8affected12.2.8 to < 12.2.8+security-04affected12.3.0 to ≤ 12.3.6affected12.3.6 to < 12.3.6+security-04affected12.4.0 to ≤ 12.4.3affected12.4.3 to < 12.4.3+security-02affected13.0.0 to ≤ 13.0.1affected13.0.1 to < 13.0.1+security-01affected