cbcvebase.
CVE-2026-33382
published 2026-07-10

CVE-2026-33382: Several Grafana API endpoints, some of them unauthenticated, do not limit the size of the request body before processing it. An attacker can send very large…

PriorityP341high7.5CVSS 3.1
AVNACLPRNUINSUCNINAH
EPSS
0.39%
32.1th percentile
Several Grafana API endpoints, some of them unauthenticated, do not limit the size of the request body before processing it. An attacker can send very large payloads that force excessive memory allocation, potentially exhausting memory and causing a denial of service.

Affected

12 ranges
VendorProductVersion rangeFixed in
grafanagrafana
grafanagrafana>= 11.6.0 < 11.6.1511.6.15
grafanagrafana>= 12.2.0 < 12.2.912.2.9
grafanagrafana>= 12.3.0 < 12.3.712.3.7
grafanagrafana>= 12.4.0 < 12.4.412.4.4
grafanagrafana>= 13.0.0 < 13.0.213.0.2
grafanagrafana_oss11.6.0 – 11.6.14
grafanagrafana_oss12.2.0 – 12.2.8
grafanagrafana_oss12.3.0 – 12.3.6
grafanagrafana_oss12.4.0 – 12.4.3
grafanagrafana_oss13.0.0 – 13.0.1
rhcephgrafana-rhel10

CVSS provenance

nvdv3.17.5HIGHCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
vendor_redhat7.5HIGH
Stop checking back — get the weekly exploitation signal.

Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.