CVE-2026-33382 — Denial of service via unbounded request body size

CVE-2026-33382

Denial of service via unbounded request body size PUBLISHED

Description (CNA)

Several Grafana API endpoints, some of them unauthenticated, do not limit the size of the request body before processing it. An attacker can send very large payloads that force excessive memory allocation, potentially exhausting memory and causing a denial of service.

Affected (CNA)

Vendor / product	Versions
Grafana / Grafana OSS	affected 11.6.0 through 11.6.14; affected 12.2.0 through 12.2.8; affected 12.3.0 through 12.3.6; affected 12.4.0 through 12.4.3; affected 13.0.0 through 13.0.1

CWE

CWE-400

References

https://grafana.com/security/security-advisories/cve-2026-33382

ADP enrichment

CISA-ADP

No English description supplied.

No references supplied.