MEDIUM 6.5 NVD

CVE-2026-33374

The Prometheus rule conversion API endpoints in Grafana do not limit request body size, allowing authenticated users to trigger unbounded memory allocations tha

The Prometheus rule conversion API endpoints in Grafana do not limit request body size, allowing authenticated users to trigger unbounded memory allocations that can crash the server through out-of-memory conditions.

References

https://grafana.com/security/security-advisories/cve-2026-33374

Published: 2026-10-13 · Source: NVD · Feed updated: 2026-10-13

This medium severity vulnerability with a CVSS score of 6.5 was published on 2026-10-13 via NVD.

vulnfeed aggregates 13242 vulnerabilities from NVD, CISA KEV, Ubuntu, Debian, Red Hat, Kubernetes, Exploit-DB, OSS-Security, GitHub and OpenStack — updated every 4 hours.