CVE-2026-33374
published 2026-10-13CVE-2026-33374: The Prometheus rule conversion API endpoints in Grafana do not limit request body size, allowing authenticated users to trigger unbounded memory allocations…
PriorityP337medium6.5CVSS 3.1
AVNACLPRLUINSUCNINAH
EPSS
0.37%
29.0th percentile
The Prometheus rule conversion API endpoints in Grafana do not limit request body size, allowing authenticated users to trigger unbounded memory allocations that can crash the server through out-of-memory conditions.
Affected
15 ranges
| Vendor | Product | Version range | Fixed in |
|---|---|---|---|
| grafana | grafana | — | — |
| grafana | grafana_enterprise | 12.0.0 – 12.3.11 | — |
| grafana | grafana_enterprise | >= 12.4.0 < 12.4.13 | 12.4.13 |
| grafana | grafana_enterprise | >= 13.0.0 < 13.0.11 | 13.0.11 |
| grafana | grafana_enterprise | >= 13.1.0 < 13.1.8 | 13.1.8 |
| grafana | grafana_enterprise | >= 13.2.0 < 13.2.4 | 13.2.4 |
| grafana | grafana_oss | 12.0.0 – 12.3.11 | — |
| grafana | grafana_oss | >= 12.4.0 < 12.4.13 | 12.4.13 |
| grafana | grafana_oss | >= 13.0.0 < 13.0.11 | 13.0.11 |
| grafana | grafana_oss | >= 13.1.0 < 13.1.8 | 13.1.8 |
| grafana | grafana_oss | >= 13.2.0 < 13.2.4 | 13.2.4 |
| multicluster-globalhub | multicluster-globalhub-grafana-rhel9 | — | — |
| rhacm2 | acm-grafana-rhel9 | — | — |
| rhceph | grafana-rhel10 | — | — |
| rhceph | grafana-rhel9 | — | — |
CVSS provenance
nvdv3.16.5MEDIUMCVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H
vendor_redhat6.5MEDIUM
Stop checking back — get the weekly exploitation signal.
Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.
GHSA
The Prometheus rule conversion API endpoints in Grafana do not limit request body size, allowing authenticated users to trigger unbounded memory allocations that can crash the server through out-of-me
ghsa_unreviewed·2026-10-13
CVE-2026-33374 [MEDIUM] CWE-400 The Prometheus rule conversion API endpoints in Grafana do not limit request body size, allowing authenticated users to trigger unbounded memory allocations that can crash the server through out-of-me
The Prometheus rule conversion API endpoints in Grafana do not limit request body size, allowing authenticated users to trigger unbounded memory allocations that can crash the server through out-of-memory conditions.
Red Hat
grafana: grafana: Denial of Service via unbounded request body size in Prometheus rule conversion API
vendor_redhat·2026-10-13·CVSS 6.5
CVE-2026-33374 [MEDIUM] CWE-770 grafana: grafana: Denial of Service via unbounded request body size in Prometheus rule conversion API
grafana: grafana: Denial of Service via unbounded request body size in Prometheus rule conversion API
A flaw was found in Grafana. The Prometheus rule conversion API endpoints fail to enforce a limit on request body sizes. An authenticated user can exploit this vulnerability by submitting excessively large requests to trigger unbounded memory allocation, which crashes the server and results in a Denial of Service (DoS).
Package: multicluster-globalhub/multicluster-globalhub-grafana-rhel9 (Multicluster Global Hub) - Fix deferred
Package: rhacm2/acm-grafana-rhel9 (Red Hat Advanced Cluster Management for Kubernetes 2) - Fix deferred
Package: rhceph/grafana-rhel9 (Red Hat Ceph Storage 7) - Fix deferred
Package: rhceph/grafana-rhel9 (Red Hat Ceph Storage 8) - Fix deferred
Package: rhceph/
No detection rules found.
No public exploits indexed.
No writeups or analysis indexed.
2026-10-13
Published