CVE-2026-33382

Fixed in a distro release EPSS <1%CVSS 7.5

Several Grafana API endpoints, some of them unauthenticated, do not limit the size of the request body before processing it. An attacker can send very large payloads that force excessive memory allocation, potentially exhausting memory and causing a denial of service.

Published 2026-07-10 · CVE record · OSV

Products: Grafana OSS

Distro releases

Release	Package	Fixed in
AlmaLinux 10	grafana	10.2.6-28.el10_2.4
AlmaLinux 10	grafana-selinux	10.2.6-28.el10_2.4
Red Hat Enterprise Linux 10.2	grafana	0:10.2.6-28.el10_2.4
Red Hat Enterprise Linux 10.2	grafana-debuginfo	0:10.2.6-28.el10_2.4
Red Hat Enterprise Linux 10.2	grafana-debugsource	0:10.2.6-28.el10_2.4
Red Hat Enterprise Linux 10.2	grafana-selinux	0:10.2.6-28.el10_2.4
Red Hat Enterprise Linux eus 10.0	grafana	0:10.2.6-26.el10_0
Red Hat Enterprise Linux eus 10.0	grafana-debuginfo	0:10.2.6-26.el10_0
Red Hat Enterprise Linux eus 10.0	grafana-debugsource	0:10.2.6-26.el10_0
Red Hat Enterprise Linux eus 10.0	grafana-selinux	0:10.2.6-26.el10_0
Red Hat hummingbird 1	grafana12.4	0:12.4.10-0.1.hum1
Red Hat hummingbird 1	grafana13.1	0:13.1.3-0.5.hum1
Red Hat hummingbird 1	grafana13.2	0:13.2.1-0.1.hum1
Rocky Linux 10	grafana	0:10.2.6-28.el10_2.4
SUSE Linux Enterprise Module for Package Hub 15 SP7	grafana	12.4.5-150200.3.91.1
SUSE Manager Client Tools 15	golang-github-prometheus-alertmanager	0.28.1-150100.4.34.1
SUSE Manager Client Tools 15	golang-github-prometheus-prometheus	3.5.4-150000.3.75.1
SUSE Manager Client Tools 15	grafana	12.4.5-150000.1.98.1
SUSE Multi Linux Manager Tools SLE-15	golang-github-prometheus-alertmanager	0.28.1-150002.4.14.1
SUSE Multi Linux Manager Tools SLE-15	golang-github-prometheus-prometheus	3.5.4-150002.3.16.1
SUSE Multi Linux Manager Tools SLE-15	grafana	12.4.5-150002.4.24.1
openSUSE Leap 16.0	grafana	12.4.5-bp160.2.1
openSUSE Tumbleweed	grafana	12.4.5-1.1