All vulnerabilities
CVE-2026-33374

Grafana Enterprise: Unbounded memory allocation in the Prometheus rule conversion API

Grafana Grafana EnterpriseApplications & CMS
Open in ThreatlineRecord JSON
CVSS
6.5Medium
ExploitationNo known exploitationNot in CISA KEV, which does not prove it is unexploitedCISA KEV
Exploit odds (EPSS)0.37%Chance of exploitation activity in the next 30 days, higher than 29% of CVEs. Scored 23 Oct 2026FIRST EPSS
Fixed in12.4.13Also 13.0.11, 13.1.8 and 1 moreCVE List
Published13 Oct 2026Updated 13 Oct 2026CVE List

What fixes it

Show all 8 fixed versions

A fixed version on one release line is not the upgrade target for every line. Check your exact version and any vendor backports.

Description

The Prometheus rule conversion API endpoints in Grafana do not limit request body size, allowing authenticated users to trigger unbounded memory allocations that can crash the server through out-of-memory conditions.

Text from CVE List

Affected versions 10

  • Grafana Enterpriseaffected: 12.0.0 through 12.3.11CVE List
  • Grafana Enterpriseaffected: 12.4.0 before 12.4.13CVE List
  • Grafana Enterpriseaffected: 13.0.0 before 13.0.11CVE List
  • Grafana Enterpriseaffected: 13.1.0 before 13.1.8CVE List
  • Grafana Enterpriseaffected: 13.2.0 before 13.2.4CVE List
  • Grafana OSSaffected: 12.0.0 through 12.3.11CVE List
  • Grafana OSSaffected: 12.4.0 before 12.4.13CVE List
  • Grafana OSSaffected: 13.0.0 before 13.0.11CVE List
  • Grafana OSSaffected: 13.1.0 before 13.1.8CVE List
  • Grafana OSSaffected: 13.2.0 before 13.2.4CVE List

References 1