CVE-2026-33374 — Unbounded memory allocation in the Prometheus rule conversion API

Description (CNA)

The Prometheus rule conversion API endpoints in Grafana do not limit request body size, allowing authenticated users to trigger unbounded memory allocations that can crash the server through out-of-memory conditions.

Affected (CNA)

Vendor / product	Versions
Grafana / Grafana Enterprise	affected 12.0.0 through 12.3.11; affected 12.4.0 before 12.4.13; affected 13.0.0 before 13.0.11; affected 13.1.0 before 13.1.8; affected 13.2.0 before 13.2.4
Grafana / Grafana OSS	affected 12.0.0 through 12.3.11; affected 12.4.0 before 12.4.13; affected 13.0.0 before 13.0.11; affected 13.1.0 before 13.1.8; affected 13.2.0 before 13.2.4

CWE

CWE-770, CWE-400, CWE-789

References

https://grafana.com/security/security-advisories/cve-2026-33374

ADP enrichment

CISA-ADP

No English description supplied.

No references supplied.