REDHAT-BUG-2499062: Medium severity Grafana Grafana vulnerability
Several Grafana API endpoints, some of them unauthenticated, do not limit the size of the request body before processing it. An attacker can send very large payloads that force excessive memory allocation, potentially exhausting memory and causing a denial of service.
Affected Software
Event History
Frequently Asked Questions
Who can exploit this issue?
Instances exposing affected Grafana API endpoints are at risk, including endpoints that can be reached without authentication. The impact is denial of service through excessive memory allocation when processing oversized request bodies.
What does an attacker need to trigger the denial of service?
An attacker needs network access to an affected API endpoint and the ability to submit a very large request body. Authentication is not required for some of the affected endpoints.
What can be done while waiting to patch?
No configuration-based workaround or detection method is provided in the available information. If patching cannot be performed immediately, restrict network access to Grafana API endpoints where possible and limit the size of incoming HTTP request bodies using controls in front of Grafana.