CVE-2026-21728

Description

Tempo queries with large limits can cause large memory allocations which can impact the availability of the service, depending on its deployment strategy. Mitigation can be done by setting max_result_limit in the search config, e.g. to 262144 (2^18). Alternatively, automatically restart the service.

References

https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-21728.json

https://grafana.com/security/security-advisories/cve-2026-21728

https://euvd.enisa.europa.eu/vulnerability/EUVD-2026-25408

https://bugzilla.redhat.com/show_bug.cgi?id=2461395

https://access.redhat.com/security/cve/CVE-2026-21728

https://access.redhat.com/errata/RHSA-2026:24503

https://access.redhat.com/errata/RHSA-2026:23345

https://access.redhat.com/errata/RHSA-2026:22423

https://access.redhat.com/errata/RHSA-2026:22347

https://access.redhat.com/errata/RHSA-2026:21769

Details

Source: Mitre, NVD

Named Vulnerability: GO-2026-5528Named Vulnerability: GHSA-p4r4-xvrq-gvmc

Risk Information

CVSS v2

CVSS v3

EPSS