← CVE Intelligence

CVE-2026-21728

Tempo query limit results in unbounded memory allocation PUBLISHED

Description (CNA)

Tempo queries with large limits can cause large memory allocations which can impact the availability of the service, depending on its deployment strategy. Mitigation can be done by setting max_result_limit in the search config, e.g. to 262144 (2^18). Alternatively, automatically restart the service.

Affected (CNA)

Vendor / productVersions
Grafana / Tempoaffected 1.3.0 through 2.8.3; affected 2.9.0 through 2.9.1; affected 2.10.0 through 2.10.1
Grafana / Enterprise Traces (GET)affected 1.0.0 through 2.8.7

CWE

No CWE identifiers supplied.

References

ADP enrichment

CISA-ADP

No English description supplied.

No references supplied.

redhat-SADP

A flaw was found in Tempo. A remote attacker can exploit this vulnerability by sending large queries to the Tempo service. This can lead to excessive memory allocations, potentially causing a Denial of Service (DoS) by impacting the availability of the service.