CVE-2026-33374
MEDIUM 6.5The Prometheus rule conversion API endpoints in Grafana do not limit request body size, allowing authenticated users to trigger unbounded memory allocations that can crash the server through out-of-memory conditions.
No known exploitation, public exploit, or elevated probability at this time. Track for changes.
Exploitation likelihood
0.4%chance of exploitation in 30 days · 30th percentile
Impact if exploited
6.5CVSS 3.1 · MEDIUM
- ConfidentialityNone
- IntegrityNone
- AvailabilityHigh
What an attacker needs
- ✓Access: Reachable over the network — no local access needed
- ⚠Privileges: Requires a low-privilege account
- ✓User interaction: No user interaction needed
- ✓Complexity: No special conditions — reliably repeatable
✓ lowers the bar for an attacker · ⚠ raises it
Proof of concept
No public PoC is currently catalogued.
Search for new PoCs
Search GitHub now — results may be empty or unverified.
Tracked sources are checked daily for recent CVEs, including PoCs published after the original disclosure. A later release appears after a tracked source lists it and a refresh succeeds.
Data snapshot:
Weakness (CWE)
- CWE-770: Allocation without limits
- CWE-400: Uncontrolled resource consumption
- CWE-789: Memory Allocation with Excessive Size Value
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H
References and research data (JSON)
Vendor product assessments
Showing 32 of 37 vendor product statements; 5 omitted. Read the full vendor advisory.
grafana12.4-0:12.4.12-0.5.hum1@aarch64 as a component of Red Hat Hardened Images · fixed
Vendor assessment for this product only.
pkg:rpm/redhat/[email protected]?arch=aarch64&distro=hummingbird-20251124&repository_id=public-hummingbird-aarch64-rpms
- vendor fix: For details on how to apply this update, which includes the changes described in this advisory, refer to: https://images.redhat.com/ Vendor guidance
grafana12.4-0:12.4.12-0.5.hum1@src as a component of Red Hat Hardened Images · fixed
Vendor assessment for this product only.
pkg:rpm/redhat/[email protected]?arch=src&distro=hummingbird-20251124&repository_id=public-hummingbird-source-rpms
- vendor fix: For details on how to apply this update, which includes the changes described in this advisory, refer to: https://images.redhat.com/ Vendor guidance
grafana12.4-0:12.4.12-0.5.hum1@x86_64 as a component of Red Hat Hardened Images · fixed
Vendor assessment for this product only.
pkg:rpm/redhat/[email protected]?arch=x86_64&distro=hummingbird-20251124&repository_id=public-hummingbird-x86_64-rpms
- vendor fix: For details on how to apply this update, which includes the changes described in this advisory, refer to: https://images.redhat.com/ Vendor guidance
grafana13.1-0:13.1.8-0.3.hum1@aarch64 as a component of Red Hat Hardened Images · fixed
Vendor assessment for this product only.
pkg:rpm/redhat/[email protected]?arch=aarch64&distro=hummingbird-20251124&repository_id=public-hummingbird-aarch64-rpms
- vendor fix: For details on how to apply this update, which includes the changes described in this advisory, refer to: https://images.redhat.com/ Vendor guidance
grafana13.1-0:13.1.8-0.3.hum1@s390x as a component of Red Hat Hardened Images · fixed
Vendor assessment for this product only.
pkg:rpm/redhat/[email protected]?arch=s390x&distro=hummingbird-20251124&repository_id=public-hummingbird-s390x-rpms
- vendor fix: For details on how to apply this update, which includes the changes described in this advisory, refer to: https://images.redhat.com/ Vendor guidance
grafana13.1-0:13.1.8-0.3.hum1@src as a component of Red Hat Hardened Images · fixed
Vendor assessment for this product only.
pkg:rpm/redhat/[email protected]?arch=src&distro=hummingbird-20251124&repository_id=public-hummingbird-source-rpms
- vendor fix: For details on how to apply this update, which includes the changes described in this advisory, refer to: https://images.redhat.com/ Vendor guidance
grafana13.1-0:13.1.8-0.3.hum1@x86_64 as a component of Red Hat Hardened Images · fixed
Vendor assessment for this product only.
pkg:rpm/redhat/[email protected]?arch=x86_64&distro=hummingbird-20251124&repository_id=public-hummingbird-x86_64-rpms
- vendor fix: For details on how to apply this update, which includes the changes described in this advisory, refer to: https://images.redhat.com/ Vendor guidance
grafana13.2-0:13.2.4-0.1.hum1@aarch64 as a component of Red Hat Hardened Images · fixed
Vendor assessment for this product only.
pkg:rpm/redhat/[email protected]?arch=aarch64&distro=hummingbird-20251124&repository_id=public-hummingbird-aarch64-rpms
- vendor fix: For details on how to apply this update, which includes the changes described in this advisory, refer to: https://images.redhat.com/ Vendor guidance
grafana13.2-0:13.2.4-0.1.hum1@s390x as a component of Red Hat Hardened Images · fixed
Vendor assessment for this product only.
pkg:rpm/redhat/[email protected]?arch=s390x&distro=hummingbird-20251124&repository_id=public-hummingbird-s390x-rpms
- vendor fix: For details on how to apply this update, which includes the changes described in this advisory, refer to: https://images.redhat.com/ Vendor guidance
grafana13.2-0:13.2.4-0.1.hum1@src as a component of Red Hat Hardened Images · fixed
Vendor assessment for this product only.
pkg:rpm/redhat/[email protected]?arch=src&distro=hummingbird-20251124&repository_id=public-hummingbird-source-rpms
- vendor fix: For details on how to apply this update, which includes the changes described in this advisory, refer to: https://images.redhat.com/ Vendor guidance
grafana13.2-0:13.2.4-0.1.hum1@x86_64 as a component of Red Hat Hardened Images · fixed
Vendor assessment for this product only.
pkg:rpm/redhat/[email protected]?arch=x86_64&distro=hummingbird-20251124&repository_id=public-hummingbird-x86_64-rpms
- vendor fix: For details on how to apply this update, which includes the changes described in this advisory, refer to: https://images.redhat.com/ Vendor guidance
multicluster-globalhub/multicluster-globalhub-grafana-rhel9 as a component of Multicluster Global Hub · known affected
Vendor assessment for this product only.
pkg:oci/multicluster-globalhub-grafana-rhel9@sha256:7092341d99cdb2da484f2770c94c48f0fc38e1c3f59c854ad7bdea0e6db8aa73?repository_url=registry.redhat.io/multicluster-globalhub/multicluster-globalhub-grafana-rhel9
- none available: Fix deferred
rhacm2/acm-grafana-rhel9 as a component of Red Hat Advanced Cluster Management for Kubernetes 2 · known affected
Vendor assessment for this product only.
pkg:oci/acm-grafana-rhel9@sha256:aa7ca316ec068e466c4a413b83b3f24a26653dc2c63497a5f6f48a8cc44c36c7?repository_url=registry.redhat.io/rhacm2/acm-grafana-rhel9
- none available: Fix deferred
rhceph/grafana-rhel9 as a component of Red Hat Ceph Storage 7 · known affected
Vendor assessment for this product only.
pkg:oci/grafana-rhel9@sha256:8bcb8976618246bc3c73f7986b7d566d9d26cda16c6043f6820f6efa2f8a3c2c?repository_url=registry.redhat.io/rhceph/grafana-rhel9
- none available: Fix deferred
rhceph/grafana-rhel10 as a component of Red Hat Ceph Storage 9 · known affected
Vendor assessment for this product only.
pkg:oci/grafana-rhel10@sha256:04469a55551c52b0c535bee8734003b4ada037bf47ec298c521e12379cdcae69?repository_url=registry.redhat.io/rhceph/grafana-rhel10
- no fix planned: Out of support scope
grafana as a component of Red Hat Enterprise Linux 10 · known affected
Vendor assessment for this product only.
pkg:rpm/redhat/grafana
- none available: Fix deferred
grafana-selinux as a component of Red Hat Enterprise Linux 10 · known affected
Vendor assessment for this product only.
pkg:rpm/redhat/grafana-selinux
- none available: Fix deferred
grafana as a component of Red Hat Enterprise Linux 8 · known affected
Vendor assessment for this product only.
pkg:rpm/redhat/grafana
- none available: Fix deferred
grafana-azure-monitor as a component of Red Hat Enterprise Linux 8 · known affected
Vendor assessment for this product only.
pkg:rpm/redhat/grafana-azure-monitor
- none available: Fix deferred
grafana-cloudwatch as a component of Red Hat Enterprise Linux 8 · known affected
Vendor assessment for this product only.
pkg:rpm/redhat/grafana-cloudwatch
- none available: Fix deferred
grafana-elasticsearch as a component of Red Hat Enterprise Linux 8 · known affected
Vendor assessment for this product only.
pkg:rpm/redhat/grafana-elasticsearch
- none available: Fix deferred
grafana-graphite as a component of Red Hat Enterprise Linux 8 · known affected
Vendor assessment for this product only.
pkg:rpm/redhat/grafana-graphite
- none available: Fix deferred
grafana-loki as a component of Red Hat Enterprise Linux 8 · known affected
Vendor assessment for this product only.
pkg:rpm/redhat/grafana-loki
- none available: Fix deferred
grafana-mssql as a component of Red Hat Enterprise Linux 8 · known affected
Vendor assessment for this product only.
pkg:rpm/redhat/grafana-mssql
- none available: Fix deferred
grafana-mysql as a component of Red Hat Enterprise Linux 8 · known affected
Vendor assessment for this product only.
pkg:rpm/redhat/grafana-mysql
- none available: Fix deferred
grafana-postgres as a component of Red Hat Enterprise Linux 8 · known affected
Vendor assessment for this product only.
pkg:rpm/redhat/grafana-postgres
- none available: Fix deferred
grafana-prometheus as a component of Red Hat Enterprise Linux 8 · known affected
Vendor assessment for this product only.
pkg:rpm/redhat/grafana-prometheus
- none available: Fix deferred
grafana-selinux as a component of Red Hat Enterprise Linux 8 · known affected
Vendor assessment for this product only.
pkg:rpm/redhat/grafana-selinux
- none available: Fix deferred
grafana-stackdriver as a component of Red Hat Enterprise Linux 8 · known affected
Vendor assessment for this product only.
pkg:rpm/redhat/grafana-stackdriver
- none available: Fix deferred
grafana.src as a component of Red Hat Enterprise Linux 8 · known affected
Vendor assessment for this product only.
pkg:rpm/redhat/grafana?arch=src
- none available: Fix deferred
grafana-selinux as a component of Red Hat Enterprise Linux 9 · known affected
Vendor assessment for this product only.
pkg:rpm/redhat/grafana-selinux
- no fix planned: Out of support scope
grafana.src as a component of Red Hat Enterprise Linux 9 · known affected
Vendor assessment for this product only.
pkg:rpm/redhat/grafana?arch=src
- no fix planned: Out of support scope
All CVSS metrics
- MEDIUM 6.5 v3.1 · CNA Primary
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H - MEDIUM 6.5 v3.1 · NVD Secondary
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H
References
Advisories
- https://grafana.com/security/security-advisories/cve-2026-33374 CVE record · GRAFANA · Updated 2026-10-13T17:05:49.782Z
NVD · CVE-2026-33374 · Updated 2026-10-16T20:02:37.630
Red Hat · CVE-2026-33374 · Updated 2026-10-21T19:42:11+00:00 - https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-33374.json Red Hat · CVE-2026-33374 · Updated 2026-10-21T19:42:11+00:00
- https://euvd.enisa.europa.eu/vulnerability/EUVD-2026-98905 EUVD · EUVD-2026-98905
Technical & other
- https://access.redhat.com/security/cve/CVE-2026-33374 Red Hat · CVE-2026-33374 · Updated 2026-10-21T19:42:11+00:00
- https://bugzilla.redhat.com/show_bug.cgi?id=2550703 Red Hat · CVE-2026-33374 · Updated 2026-10-21T19:42:11+00:00
- https://www.cve.org/CVERecord?id=CVE-2026-33374 Red Hat · CVE-2026-33374 · Updated 2026-10-21T19:42:11+00:00
- https://nvd.nist.gov/vuln/detail/CVE-2026-33374 Red Hat · CVE-2026-33374 · Updated 2026-10-21T19:42:11+00:00
- https://access.redhat.com/errata/RHSA-2026:84422 Red Hat · CVE-2026-33374 · Updated 2026-10-21T19:42:11+00:00
- https://access.redhat.com/errata/RHSA-2026:87077 Red Hat · CVE-2026-33374 · Updated 2026-10-21T19:42:11+00:00
- https://access.redhat.com/errata/RHSA-2026:85544 Red Hat · CVE-2026-33374 · Updated 2026-10-21T19:42:11+00:00