CVE-2026-28383: falha de média gravidade em Grafana OSS
Grafana plugin resources can lead to unbounded memory allocation
Publicada em · Atualizada em
Aviso por e-mail quando ela entrar no KEV, ganhar PoC pública ou subir de nota.
13Vexday Risk Score
Sem sinal de exploração. Nenhum artefato público de exploração conhecido até agora.
ssvc Trackcvss 6.5epss 0.3%
A request to the Grafana plugin resources endpoint can cause unbounded memory allocation by reading the entire request body into memory. An authenticated user can exploit this to trigger an out-of-memory condition, potentially causing a denial of service.
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H
Produtos afetados
Grafana · Grafana OSSCVEs relacionadas — Grafana OSS
No mesmo produto, das mais perigosas para as menos.
CVE-2026-15815HIGHCVE-2026-15815 CVE RecordEPSS 0.7%CVE-2026-33375MEDIUMGrafana MSSQL Data Source Plugin: Restriction Bypass Leading to OOM DoSEPSS 0.5%CVE-2026-42129HIGHPath traversal in the Loki data source pluginEPSS 0.4%CVE-2026-42127HIGHPre-authentication denial of service in the public dashboard query endpointEPSS 0.4%CVE-2026-19475MEDIUMSQL Data Source Plugin: OOM DoS via $__timeGroup macroEPSS 0.4%CVE-2026-8609MEDIUMPre-authentication denial of service via the OAuth login routeEPSS 0.4%