CVE-2026-21720: Unauthenticated DoS: avatar cache leaks goroutines when /avatar/:hash requests time out
Every uncached /avatar/:hash request spawns a goroutine that refreshes the Gravatar image. If the refresh sits in the 10-slot worker queue longer than three seconds, the handler times out and stops listening for the result, so that goroutine blocks forever trying to send on an unbuffered channel. Sustained traffic with random hashes keeps tripping this timeout, so goroutine count grows linearly, eventually exhausting memory and causing Grafana to crash on some systems.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Compensating control
Place a rate-limiting control in front of Grafana for requests to the /avatar/:hash path (for example via WAF, reverse proxy or API gateway). Limit requests per IP and global RPS/concurrency for that endpoint to prevent sustained random-hash traffic from queuing worker tasks and causing goroutine growth.
- Compensating control
Restrict or block unauthenticated access to the /avatar/:hash endpoint using firewall rules, reverse-proxy access controls, or ACLs. Only allow access from trusted networks or authenticated clients to reduce exposure to unauthenticated DoS against avatar fetching.
- Operational
Monitor Grafana process memory and goroutine counts and create alerts for abnormal growth. If the leak is triggered and Grafana becomes unstable, restart the Grafana service/process to recover memory and clear leaked goroutines until a code fix can be applied.
Event History
Frequently Asked Questions
What is the severity of CVE-2026-21720?
CVE-2026-21720 is classified as a denial of service (DoS) vulnerability that can be exploited by attackers.
How do I fix CVE-2026-21720?
To mitigate CVE-2026-21720, it is recommended to update Grafana to the latest version that addresses this vulnerability.
What versions of Grafana are affected by CVE-2026-21720?
CVE-2026-21720 affects Grafana versions from 3.0.0 to 11.6.9 and specific ranges in versions 12.0.0-12.2.3.
What specific issue does CVE-2026-21720 cause?
CVE-2026-21720 allows for denial of service by leaking goroutines when requests for uncached avatars time out.
Who is impacted by CVE-2026-21720?
Any users or organizations utilizing the affected versions of Grafana are at risk of experiencing service interruptions due to CVE-2026-21720.