TI-2026-25780 CVE-2026-33382 · GHSA-xcrv-g5fh-9wx2
Denial of service via unbounded request body size
Priority LOW 39
Several Grafana API endpoints, some of them unauthenticated, do not limit the size of the request body before processing it.
RHSA-2026:90811
grafana security update
Released 2026-10-29 · Red Hat rating Moderate · View on Red Hat →
Fixed in
- Red Hat Enterprise Linux AppStream (v. 9) grafana-10.2.6-23.el9_8.4, grafana-selinux-10.2.6-23.el9_8.4
Fixes 2 records
TI-2026-07565 CVE-2026-8609 · GHSA-j7jj-549c-j492
Pre-authentication denial of service via the OAuth login route
Priority LOW 39
An unauthenticated attacker can repeatedly call Grafana's OAuth login route with unique values, causing unbounded memory growth that can eventually exhaust memory and crash the Grafana instance (denial of service).