medium6.5
CVE-2026-28376
The Grafana Live push endpoint can be exploited to cause unbounded memory allocation by sending a large or streaming request body, potentially leading to out-o…
Impact
The Grafana Live push endpoint can be exploited to cause unbounded memory allocation by sending a large or streaming request body, potentially leading to out-of-memory conditions. An authenticated user with access to the Grafana Live API can trigger this issue.
Affected products
| Vendor | Product | Affected versions |
|---|---|---|
| Grafana | Grafana | from 8.0.0 before 11.6.14 from 12.0.0 before 12.2.8 from 12.3.0 before 12.3.6 from 12.4.0 before 12.4.3 Versions 11.6.14, 12.2.8 |