CVE-2026-21728: Tempo query limit results in unbounded memory allocation
Tempo queries with large limits can cause large memory allocations which can impact the availability of the service, depending on its deployment strategy.
Mitigation can be done by setting maxresultlimit in the search config, e.g. to 262144 (2^18).
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Configuration
Set max_result_limit in the search config to 262144 (2^18) to limit result sizes and prevent unbounded memory allocation from Tempo queries with large limits.
Tempo search config max_result_limit = 262144 - Operational
Automatically restart the Tempo service after changing the search configuration (e.g., after updating max_result_limit).
Event History
Frequently Asked Questions
What is the severity of CVE-2026-21728?
CVE-2026-21728 has a high severity due to its potential to cause unbounded memory allocation, impacting service availability.
How do I fix CVE-2026-21728?
To fix CVE-2026-21728, set the max_result_limit in the search configuration to a lower value, such as 262144.
Which software is affected by CVE-2026-21728?
CVE-2026-21728 affects Grafana Tempo due to vulnerabilities in its query handling.
What impact does CVE-2026-21728 have on services?
CVE-2026-21728 can lead to service availability issues due to excessive memory allocation when processing large queries.
Is there a configuration setting to mitigate CVE-2026-21728?
Yes, adjusting the max_result_limit in the search configuration can help mitigate the risks associated with CVE-2026-21728.