BIT-grafana-2026-33382

vendorUSosv

Denial of service via unbounded request body size

view advisory published 2026-07-14Licence: per source

Several Grafana API endpoints, some of them unauthenticated, do not limit the size of the request body before processing it. An attacker can send very large payloads that force excessive memory allocation, potentially exhausting memory and causing a denial of service.

describes (1)

Related CVEs.

ID	severity	EPSS	exploitable	published
CVE-2026-33382US	—	0.39% (33rd)	—	2026-07-10
Several Grafana API endpoints, some of them unauthenticated, do not limit the size of the request body before processing it. An attacker can send very large payloads that force exc…

references

External citations — patches, advisories, analysis.

https://grafana.com/security/security-advisories/cve-2026-33382ADVISORY
https://nvd.nist.gov/vuln/detail/CVE-2026-33382WEB

scry

Advisories like this name the exposed products attackers go after on your perimeter. See what is exposed on your perimeter with a free passive scan.

Free scan