{
  "threat_severity" : "Moderate",
  "public_date" : "2026-07-10T14:58:23Z",
  "bugzilla" : {
    "description" : "grafana: Grafana: Denial of Service via excessive memory allocation from large API request payloads",
    "id" : "2499062",
    "url" : "https://bugzilla.redhat.com/show_bug.cgi?id=2499062"
  },
  "cvss3" : {
    "cvss3_base_score" : "5.3",
    "cvss3_scoring_vector" : "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L",
    "status" : "verified"
  },
  "cwe" : "CWE-770",
  "details" : [ "Several Grafana API endpoints, some of them unauthenticated, do not limit the size of the request body before processing it. An attacker can send very large payloads that force excessive memory allocation, potentially exhausting memory and causing a denial of service.", "A flaw in Grafana's API endpoints allows remote attackers to send excessively large request bodies without authentication. This exhausts server memory, resulting in a complete denial of service (DoS)." ],
  "statement" : "Moderate: This denial of service vulnerability in Grafana stems from a lack of request body size limits on certain API endpoints, some of which are unauthenticated. Exploitation by a remote attacker sending large payloads can exhaust system memory, leading to service unavailability. The impact is assessed as Moderate because it primarily affects the availability of the Grafana application rather than compromising data or executing arbitrary code.",
  "affected_release" : [ {
    "product_name" : "Red Hat Enterprise Linux 10",
    "release_date" : "2026-08-12T00:00:00Z",
    "advisory" : "RHSA-2026:54178",
    "cpe" : "cpe:/o:redhat:enterprise_linux:10.2",
    "package" : "grafana-0:10.2.6-28.el10_2.4"
  }, {
    "product_name" : "Red Hat Hardened Images",
    "release_date" : "2026-09-03T00:00:00Z",
    "advisory" : "RHSA-2026:63164",
    "cpe" : "cpe:/a:redhat:hummingbird:1",
    "package" : "grafana13-2-main-13.2.1-0.1.hum1"
  }, {
    "product_name" : "Red Hat Hardened Images",
    "release_date" : "2026-09-03T00:00:00Z",
    "advisory" : "RHSA-2026:63165",
    "cpe" : "cpe:/a:redhat:hummingbird:1",
    "package" : "grafana13-1-main-13.1.3-0.5.hum1"
  }, {
    "product_name" : "Red Hat Hardened Images",
    "release_date" : "2026-09-08T00:00:00Z",
    "advisory" : "RHSA-2026:65157",
    "cpe" : "cpe:/a:redhat:hummingbird:1",
    "package" : "grafana12-4-main-12.4.10-0.1.hum1"
  } ],
  "package_state" : [ {
    "product_name" : "Multicluster Global Hub",
    "fix_state" : "Not affected",
    "package_name" : "multicluster-globalhub/multicluster-globalhub-grafana-rhel9",
    "cpe" : "cpe:/a:redhat:multicluster_globalhub"
  }, {
    "product_name" : "Red Hat Advanced Cluster Management for Kubernetes 2",
    "fix_state" : "Not affected",
    "package_name" : "rhacm2/acm-grafana-rhel9",
    "cpe" : "cpe:/a:redhat:acm:2"
  }, {
    "product_name" : "Red Hat Ceph Storage 5",
    "fix_state" : "Not affected",
    "package_name" : "rhceph/rhceph-5-dashboard-rhel8",
    "cpe" : "cpe:/a:redhat:ceph_storage:5"
  }, {
    "product_name" : "Red Hat Ceph Storage 6",
    "fix_state" : "Not affected",
    "package_name" : "rhceph/rhceph-6-dashboard-rhel9",
    "cpe" : "cpe:/a:redhat:ceph_storage:6"
  }, {
    "product_name" : "Red Hat Ceph Storage 7",
    "fix_state" : "Not affected",
    "package_name" : "rhceph/grafana-rhel9",
    "cpe" : "cpe:/a:redhat:ceph_storage:7"
  }, {
    "product_name" : "Red Hat Ceph Storage 8",
    "fix_state" : "Not affected",
    "package_name" : "rhceph/grafana-rhel9",
    "cpe" : "cpe:/a:redhat:ceph_storage:8"
  }, {
    "product_name" : "Red Hat Ceph Storage 9",
    "fix_state" : "Fix deferred",
    "package_name" : "rhceph/grafana-rhel10",
    "cpe" : "cpe:/a:redhat:ceph_storage:9"
  }, {
    "product_name" : "Red Hat Enterprise Linux 8",
    "fix_state" : "Not affected",
    "package_name" : "grafana",
    "cpe" : "cpe:/o:redhat:enterprise_linux:8"
  }, {
    "product_name" : "Red Hat Enterprise Linux 9",
    "fix_state" : "Not affected",
    "package_name" : "grafana",
    "cpe" : "cpe:/o:redhat:enterprise_linux:9"
  }, {
    "product_name" : "Red Hat Hardened Images",
    "fix_state" : "Not affected",
    "package_name" : "hi/grafana",
    "cpe" : "cpe:/a:redhat:hummingbird:1"
  } ],
  "references" : [ "https://www.cve.org/CVERecord?id=CVE-2026-33382\nhttps://nvd.nist.gov/vuln/detail/CVE-2026-33382\nhttps://grafana.com/security/security-advisories/cve-2026-33382" ],
  "name" : "CVE-2026-33382",
  "mitigation" : {
    "value" : "Deploy a reverse proxy or API gateway (e.g., Nginx) in front of Grafana configured to strictly limit the maximum HTTP request body size, dropping oversized payloads before they reach the backend. As a defense-in-depth measure, restrict network access to trusted internal clients via firewall rules. Note: Applying these proxy and network changes may require a service reload, causing a temporary interruption.",
    "lang" : "en:us"
  },
  "csaw" : false
}