CVE-2025-1088
Fixed in a distro release EPSS <1%CVSS 2.7
In Grafana, an excessively long dashboard title or panel name will cause Chromium browsers to become unresponsive due to Improper Input Validation vulnerability in Grafana. This issue affects Grafana: before 11.6.2 and is fixed in 11.6.2 and higher.
Products: grafana
Fixed upstream
| Ecosystem | Package | Fixed in |
|---|---|---|
| Go | github.com/grafana/grafana | 11.6.2 |
| Go | github.com/grafana/grafana | 0.0.0-20250521211231-e0ba4b480954 |
Distro releases
| Release | Package | Fixed in |
|---|---|---|
| Chainguard | grafana-11.3 | 0 |
| Chainguard | grafana-11.4 | 0 |
| Chainguard | grafana-11.5 | 0 |
| Chainguard | grafana-11.5-oci-compat | 0 |
| Chainguard | grafana-fips-11.5 | 0 |
| Chainguard | grafana-fips-11.5-oci-compat | 0 |
| Chainguard | grafana-fips-11.6 | 11.6.2-r0 |
| Chainguard | grafana-fips-12.0 | 12.0.10-r6 |
| Chainguard | grafana-fips-12.1 | 12.1.10.01-r3 |
| Chainguard | grafana-fips-12.2 | 0 |
| Chainguard | grafana-fips-12.3 | 0 |
| Chainguard | grafana-fips-12.4 | 0 |
| Chainguard | grafana-fips-13.0 | 0 |
| Chainguard | grafana-fips-13.1 | 13.1.0-r0 |
| Ubuntu 16.04 LTS | grafana | no fix |
| openSUSE Tumbleweed | govulncheck-vulndb | 0.0.20250730T213748-1.1 |
| openSUSE Tumbleweed | grafana | 11.6.3-1.1 |