CVE-2026-21728 | BDVDB-2026-328764 Detail
GrafanaTempo
Description#
Tempo queries with large limits can cause large memory allocations which can impact the availability of the service, depending on its deployment strategy. Mitigation can be done by setting max_result_limit in the search config, e.g. to 262144 (2^18). Alternatively, automatically restart the service.
Impact#
Per CVSS v3.1: confidentiality impact none, integrity impact none, availability impact high. Attack vector: network.
Weaknesses#
References#
- https://grafana.com/security/security-advisories/cve-2026-21728
- https://access.redhat.com/security/cve/CVE-2026-21728
- https://bugzilla.redhat.com/show_bug.cgi?id=2461395
- https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-21728.json
- https://access.redhat.com/errata/RHSA-2026:22423
- https://access.redhat.com/errata/RHSA-2026:22347
- https://access.redhat.com/errata/RHSA-2026:23345
- https://access.redhat.com/errata/RHSA-2026:24503
- https://access.redhat.com/errata/RHSA-2026:21769
Exploit#
No public exploit known
History#
- Version 1Record published in the CVE List.
- Version 2Most recent update recorded in the CVE List.