CVE-2026-33374: Unbounded memory allocation in the Prometheus rule conversion API
Published Oct 13, 2026
·Updated
The Prometheus rule conversion API endpoints in Grafana do not limit request body size, allowing authenticated users to trigger unbounded memory allocations that can crash the server through out-of-memory conditions.
Affected Software
1 affected component
Grafana Labs Grafana
Event History
Oct 13, 2026
CVE Published
via MITRE·05:05 PM
Data Sourced
via MITRE·05:05 PM
DescriptionSeverityWeakness
Data Sourced
via NVD·06:17 PM
DescriptionSeverityWeakness
Frequently Asked Questions
1
Who can exploit this issue?
An attacker must be authenticated to Grafana and able to send requests to the Prometheus rule conversion API endpoints over the network. No user interaction is required.
2
What is the expected impact of a successful attack?
Successful exploitation can exhaust server memory and crash the Grafana server, causing a denial of service. The provided severity vector indicates no confidentiality or integrity impact.