exploitDog

CVE-2026-33382

Опубликовано: 10 июл. 2026

Источник: nvd

CVSS3: 7.5

EPSS Низкий

Описание

Several Grafana API endpoints, some of them unauthenticated, do not limit the size of the request body before processing it. An attacker can send very large payloads that force excessive memory allocation, potentially exhausting memory and causing a denial of service.

Ссылки

https://grafana.com/security/security-advisories/cve-2026-33382
Vendor Advisory

Уязвимые конфигурации

Конфигурация 1

Одно из

cpe:2.3:a:grafana:grafana:*:*:*:*:-:*:*:*

Версия от 11.6.0 (включая) до 11.6.15 (исключая)

cpe:2.3:a:grafana:grafana:*:*:*:*:-:*:*:*

Версия от 12.2.0 (включая) до 12.2.9 (исключая)

cpe:2.3:a:grafana:grafana:*:*:*:*:-:*:*:*

Версия от 12.3.0 (включая) до 12.3.7 (исключая)

cpe:2.3:a:grafana:grafana:*:*:*:*:-:*:*:*

Версия от 12.4.0 (включая) до 12.4.4 (исключая)

cpe:2.3:a:grafana:grafana:*:*:*:*:-:*:*:*

Версия от 13.0.0 (включая) до 13.0.2 (исключая)

EPSS

Процентиль: 31%

0.00388

Низкий

7.5 High

CVSS3

Дефекты

CWE-400

Связанные уязвимости

CVE-2026-33382

CVSS3: 5.3

redhat

20 дней назад

Several Grafana API endpoints, some of them unauthenticated, do not limit the size of the request body before processing it. An attacker can send very large payloads that force excessive memory allocation, potentially exhausting memory and causing a denial of service.

GHSA-xcrv-g5fh-9wx2

CVSS3: 7.5

github

20 дней назад

Several Grafana API endpoints, some of them unauthenticated, do not limit the size of the request body before processing it. An attacker can send very large payloads that force excessive memory allocation, potentially exhausting memory and causing a denial of service.

openSUSE-SU-2026:21366-1

suse-cvrf

14 дней назад

Security update for grafana

EPSS

Процентиль: 31%

0.00388

Низкий

7.5 High

CVSS3

Дефекты

CWE-400