Skip to content
VulniPulse
Sign in
Highest advisory severityMedium 1 vendor · 1 advisory

CVE-2026-33382

CVE-2026-33382: 1 tracked advisory record across Red Hat. Compare vendor sources and published fix guidance.

Compare the source-linked records below. Ratings and product/version details belong to each advisory; they are not a single CVE-wide score or proof that every listed product is affected. How VulniPulse collects and checks evidence.

NVD detail CVE.org

Vendor advisory comparison

Red Hat

1 advisory
  • Advisory severityMedium5.3

    Medium [CVE-2026-33382] Denial of Service via excessive memory allocation from large API request payloads

    CVE-2026-33382Source published Source updated

    Several Grafana API endpoints, some of them unauthenticated, do not limit the size of the request body before processing it. An attacker can send very large payloads that force excessive memory allocation, potentially exhausting memory and causing a denial of service. A flaw in Grafana's API endpoints allows remote attackers to send excessively large request bodies without authentication. This exhausts server memory, resulting in a complete denial of service (DoS). Moderate: This denial of service vulnerability in Grafana stems from a lack of request body size limits on certain API endpoints, some of which are unauthenticated. Exploitation by a remote attacker sending large payloads can exhaust system memory, leading to service unavailability. The impact is assessed as Moderate because…

    Affected products in this advisory
    • Red Hat Enterprise Linux 10.0 Extended Update Support
    • Red Hat Hardened Images
    • Red Hat Ceph Storage 9
    • Red Hat Enterprise Linux 9

    1 more entries in the full advisory.

    Source-reported affected versions
    Affected-version details not available in this record.
    Source-reported fixed versions
    • grafana-0:10.2.6-28.el10_2.4
    • grafana-0:10.2.6-26.el10_0
    • grafana13-2-main-13.2.1-0.1.hum1
    • grafana13-1-main-13.1.3-0.5.hum1

    6 more entries in the full advisory.

    Mitigation guidance
    • Deploy a reverse proxy or API gateway (e.g., Nginx) in front of Grafana configured to strictly limit the maximum HTTP request body size, dropping oversized payloads before they reach the backend. As a defense-in-depth measure, restrict network access to trusted internal clients via firewall rules. Note: Applying these proxy and network changes may require a service reload, causing a temporary interruption.
    Full advisory and evidenceOpen source bulletin

Android app · Google Play

Monitor future Red Hat CVEs from your phone.

Choose a whole vendor or a precise platform, then receive matching security advisories by phone notification, email, or both. Coverage follows 34 official vendor sources and 160+ reviewed platform categories.

Matching phone alertsOptional email delivery
Get CVE alertsSee app features