CVE record · 1 source
CVE-2026-33374
CVSS 6.5The Prometheus rule conversion API endpoints in Grafana do not limit request body size, allowing authenticated users to trigger unbounded memory…
- Vendor
- Prometheus, Grafana Labs
- Product
- Prometheus / Alertmanager, Grafana / Loki / Tempo / Mimir
- CVSS
- 6.5
- Exposure class
- Network management
Coverage
1Every item in the archive that references this CVE, highest rank first. Headlines open the publisher.
-
The Prometheus rule conversion API endpoints in Grafana do not limit request body size, allowing authenticated users to trigger unbounded memory…
The Prometheus rule conversion API endpoints in Grafana do not limit request body size, allowing authenticated users to trigger unbounded memory allocations that can crash the server through out-of-memory conditions.