CVE-2026-33374

medium

Description

The Prometheus rule conversion API endpoints in Grafana do not limit request body size, allowing authenticated users to trigger unbounded memory allocations that can crash the server through out-of-memory conditions.

References

https://grafana.com/security/security-advisories/cve-2026-33374

https://euvd.enisa.europa.eu/vulnerability/EUVD-2026-98905

Details

Source: Mitre, NVD

Published: 2026-10-13

Updated: 2026-10-16

Risk Information

CVSS v2

Base Score: 6.8

Vector: CVSS2#AV:N/AC:L/Au:S/C:N/I:N/A:C

Severity: Medium

CVSS v3

Base Score: 6.5

Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H