CVE-2026-28376
EUVD-2026-3013813.05.2026, 20:16
The Grafana Live push endpoint can be exploited to cause unbounded memory allocation by sending a large or streaming request body, potentially leading to out-of-memory conditions. An authenticated user with access to the Grafana Live API can trigger this issue.Enginsight
Affected Products (NVD)
| Vendor | Product | Version |
|---|---|---|
| grafana | grafana | 8.0.0 ≤ 𝑥 < 11.6.14 |
| grafana | grafana | 12.0.0 ≤ 𝑥 < 12.2.8 |
| grafana | grafana | 12.3.0 ≤ 𝑥 < 12.3.6 |
| grafana | grafana | 12.4.0 ≤ 𝑥 < 12.4.3 |
| grafana | grafana | 11.6.14 |
| grafana | grafana | 11.6.14:security01 |
| grafana | grafana | 12.2.8 |
| grafana | grafana | 12.2.8:security01 |
| grafana | grafana | 12.3.6 |
| grafana | grafana | 12.3.6:security01 |
| grafana | grafana | 12.4.3 |
| grafana | grafana | 13.0.0 |
| grafana | grafana | 13.0.1 |
𝑥
= Vulnerable software versions