Excessive Memory Allocation Vulnerability in Grafana by Grafana Labs
CVE-2026-107509

6.5MEDIUM

Key Information:

Vendor

Grafana
Status
Grafana Oss
Grafana Enterprise
Vendor
CVE Published:
11 November 2026

What is CVE-2026-107509?

A vulnerability exists within Grafana that allows users with Viewer role privileges to initiate memory allocation requests that can exceed normal limits. By executing a single SQL Expression query that casts a value to an excessively large BINARY length, an attacker can make Grafana allocate an unbounded amount of memory. This can lead to system crashes and hinder the application's overall performance. Users are advised to upgrade to the latest version and review security practices to mitigate potential risks.

Affected Version(s)

Grafana Enterprise 13.1.0 <= 13.1.9

Grafana Enterprise 13.2.0 <= 13.2.5

Grafana Enterprise 13.3.0

References

https://grafana.com/security/security-advisories/cve-2026...
vendor-advisory

CVSS V3.1

Score:
6.5
Severity:
MEDIUM
Confidentiality:
None
Integrity:
None
Availability:
None
Attack Vector:
Network
Attack Complexity:
Low
Privileges Required:
Low
User Interaction:
None
Scope:
Unchanged

Timeline

  • Vulnerability published

  • Vulnerability Reserved

Credit

lucifer_
.