Unbounded Memory Allocation in Grafana by Prometheus Rule Conversion API
CVE-2026-33374

6.5MEDIUM

Key Information:

Vendor

Grafana
Status
Grafana Enterprise
Grafana Oss
Vendor
CVE Published:
13 October 2026

What is CVE-2026-33374?

The Prometheus rule conversion API endpoints in Grafana have a significant vulnerability where there is no limit on the request body size. This allows authenticated users to send excessively large requests, which can lead to unbounded memory allocations. As a consequence, this may overwhelm system resources and potentially cause the server to crash due to out-of-memory errors. It is crucial for organizations using Grafana to apply necessary mitigations and monitor their API usage to safeguard against this issue.

Affected Version(s)

Grafana Enterprise 12.0.0 <= 12.3.11

Grafana Enterprise 12.4.0 < 12.4.13

Grafana Enterprise 13.0.0 < 13.0.11

References

https://grafana.com/security/security-advisories/cve-2026...
vendor-advisory

CVSS V3.1

Score:
6.5
Severity:
MEDIUM
Confidentiality:
None
Integrity:
None
Availability:
None
Attack Vector:
Network
Attack Complexity:
Low
Privileges Required:
Low
User Interaction:
None
Scope:
Unchanged

Timeline

  • Vulnerability published

  • Vulnerability Reserved

.