Skip to content
CVE PROGRAM SOURCE RECORD6.5 Medium

CVE-2026-33374

Unbounded memory allocation in the Prometheus rule conversion API

Read JSON ↗CVE.org ↗
Status
Published
Published
Updated
Assigning organization
GRAFANA

Description

The Prometheus rule conversion API endpoints in Grafana do not limit request body size, allowing authenticated users to trigger unbounded memory allocations that can crash the server through out-of-memory conditions.

Affected products

Version statuses are supplied by the assigning organization. Consult the original record for detailed ranges and platform conditions.

Grafana Grafana Enterprise

Default version status: unaffected

  • 12.0.0 to ≤ 12.3.11affected
  • 12.4.0 to < 12.4.13affected
  • 13.0.0 to < 13.0.11affected
  • 13.1.0 to < 13.1.8affected
  • 13.2.0 to < 13.2.4affected

Grafana Grafana OSS

Default version status: unaffected

  • 12.0.0 to ≤ 12.3.11affected
  • 12.4.0 to < 12.4.13affected
  • 13.0.0 to < 13.0.11affected
  • 13.1.0 to < 13.1.8affected
  • 13.2.0 to < 13.2.4affected

References