CVE-2026-33374
Received Received - Intake

Memory Exhaustion in Grafana Prometheus Rule Conversion API

Publication date: 2026-10-13

Last updated on: 2026-10-13

Assigner: Grafana Labs

Description
The Prometheus rule conversion API endpoints in Grafana do not limit request body size, allowing authenticated users to trigger unbounded memory allocations that can crash the server through out-of-memory conditions.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-10-13
Last Modified
2026-10-13
Generated
2026-10-13
AI Q&A
2026-10-13
EPSS Evaluated
N/A
NVD
CVE-2026-33374
EUVD
EUVD-2026-98905

Affected Vendors & Products

Showing 10 associated CPEs
Vendor Product Version / Range
Grafana Grafana Enterprise 12.0.0
Grafana Grafana Enterprise 12.4.0
Grafana Grafana Enterprise 13.0.0
Grafana Grafana Enterprise 13.1.0
Grafana Grafana Enterprise 13.2.0
Grafana Grafana OSS 12.0.0
Grafana Grafana OSS 12.4.0
Grafana Grafana OSS 13.0.0
Grafana Grafana OSS 13.1.0
Grafana Grafana OSS 13.2.0

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-789 The product allocates memory based on an untrusted, large size value, but it does not ensure that the size is within expected limits, allowing arbitrary amounts of memory to be allocated.
CWE-770 The product allocates a reusable resource or group of resources on behalf of an actor without imposing any intended restrictions on the size or number of resources that can be allocated.
CWE-400 The product does not properly control the allocation and maintenance of a limited resource.

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

This vulnerability in Grafana's Prometheus rule conversion API endpoints allows authenticated users to send requests with unlimited body sizes. This can cause the server to allocate excessive memory, leading to out-of-memory conditions and potential crashes.

Detection Guidance

Monitor for high memory usage or crashes in Grafana servers. Check logs for large request bodies to the Prometheus rule conversion API endpoints. Use system monitoring tools like top, htop, or Grafana metrics to detect unusual memory consumption.

Impact Analysis

An attacker with access could crash the Grafana server by sending large requests, causing denial of service. This disrupts monitoring and visualization services relying on Grafana.

Mitigation Strategies

Apply Grafana updates that limit request body size for the Prometheus rule conversion API. Configure network firewalls or reverse proxies to restrict request sizes. Monitor server memory usage closely until mitigation is applied.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-33374. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart