Medium [CVE-2026-33382] Denial of Service via excessive memory allocation from large API request payloads
This medium-severity Red Hat Linux advisory covers CVE-2026-33382 affecting Red Hat Enterprise Linux 10.0 Extended Update Support, Red Hat Hardened Images, Red Hat Ceph Storage 9.
Aggregated and source-linked by VulniPulse. Data sources, validation and limitations.
VulniPulse record published Record updated
Android app · Google Play
Monitor future Red Hat Linux CVEs from your phone.
Choose a whole vendor or a precise platform, then receive matching security advisories by phone notification, email, or both. Coverage follows 34 official vendor sources and 160+ reviewed platform categories.
Summary
Several Grafana API endpoints, some of them unauthenticated, do not limit the size of the request body before processing it. An attacker can send very large payloads that force excessive memory allocation, potentially exhausting memory and causing a denial of service.
A flaw in Grafana's API endpoints allows remote attackers to send excessively large request bodies without authentication. This exhausts server memory, resulting in a complete denial of service (DoS).
Moderate: This denial of service vulnerability in Grafana stems from a lack of request body size limits on certain API endpoints, some of which are unauthenticated. Exploitation by a remote attacker sending large payloads can exhaust system memory, leading to service unavailability.
The impact is assessed as Moderate because it primarily affects the availability of the Grafana application rather than compromising data or executing arbitrary code. Red Hat severity: Moderate — CVSS 5.3 (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L).
Weakness: CWE-770. Affected Red Hat products: Red Hat Enterprise Linux 10; Red Hat Enterprise Linux 10.0 Extended Update Support; Red Hat Hardened Images; Red Hat Ceph Storage 9; Red Hat Enterprise Linux 9.
Affected products named by the advisory: Red Hat package: grafana.
Affected versions
No affected-version range was extracted from the source record. The vendor advisory is authoritative — check it before change work.
Official advisory · high-confidence parse· fetched 19 days ago·verify at source
- grafana-0:10.2.6-28.el10_2.4
- grafana-0:10.2.6-26.el10_0
- grafana13-2-main-13.2.1-0.1.hum1
- grafana13-1-main-13.1.3-0.5.hum1
- grafana12-4-main-12.4.10-0.1.hum1
- RHSA-2026:54178
- RHSA-2026:67517
- RHSA-2026:63164
- RHSA-2026:63165
- RHSA-2026:65157
Official advisory · high-confidence parse· fetched 19 days ago·verify at source
Mitigation checklist
- Deploy a reverse proxy or API gateway (e.g., Nginx) in front of Grafana configured to strictly limit the maximum HTTP request body size, dropping oversized payloads before they reach the backend. As a defense-in-depth measure, restrict network access to trusted internal clients via firewall rules. Note: Applying these proxy and network changes may require a service reload, causing a temporary interruption.
Official advisory · high-confidence parse· fetched 19 days ago·verify at source
Discussion(0)
No comments yet. Share field notes, upgrade gotchas, or questions — verify against the vendor advisory before acting on community advice.
Sign in to join the discussion.