CVE-2026-33382: Denial of service via unbounded request body size
Several Grafana API endpoints, some of them unauthenticated, do not limit the size of the request body before processing it. An attacker can send very large payloads that force excessive memory allocation, potentially exhausting memory and causing a denial of service.
Affected Software
Event History
Frequently Asked Questions
What is the severity of CVE-2026-33382?
The severity of CVE-2026-33382 is rated high with a score of 7.5.
How do I fix CVE-2026-33382?
To fix CVE-2026-33382, ensure that you limit the size of request bodies for the affected Grafana API endpoints.
What kind of attack does CVE-2026-33382 allow?
CVE-2026-33382 allows an attacker to conduct a denial of service attack by submitting excessively large payloads to Grafana API endpoints.
Which software is affected by CVE-2026-33382?
CVE-2026-33382 affects Grafana Labs Grafana software.
What is the risk associated with CVE-2026-33382?
The risk associated with CVE-2026-33382 is rated 43, indicating a significant potential for denial of service exploitation.