CVE-2026-21720: Unauthenticated DoS: avatar cache leaks goroutines when /avatar/:hash requests time out
Vulnerability summary
CVE-2026-21720 is a high (CVSS 7.5) Uncontrolled Resource Consumption vulnerability in grafana. EPSS estimates a 0.69% chance of exploitation in the next 30 days, higher than 52.8% of scored vulnerabilities.
Severe, CVSS 7.5 (CVE.org); no exploitation reported by the 5 checked sources; EPSS 1% (FIRST, 03-11-2026)
Source freshness unavailable
How is this decided?Advisory lineage
Upstream 0 · Downstream 4 · Related 5Timeline
- 27-01-2026PublishedVulnerability first disclosed.
- 27-08-2026Last modifiedVulnerability information updated.
Description
Every uncached /avatar/:hash request spawns a goroutine that refreshes the Gravatar image. If the refresh sits in the 10-slot worker queue longer than three seconds, the handler times out and stops listening for the result, so that goroutine blocks forever trying to send on an unbuffered channel. Sustained traffic with random hashes keeps tripping this timeout, so goroutine count grows linearly, eventually exhausting memory and causing Grafana to crash on some systems.
CVSS metrics
4 scores · 4 sources · 1 version- OSV · UbuntuEcosystem advisory · calculated7.5HighCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
- OSV · ChainguardEcosystem advisory · calculated7.5HighCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
- NVDNIST7.5HighCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
EPSS trend
Probability
0.69%
Chance of exploitation in the next 30 days
Percentile
53%
Versus all other CVEs
30-day change
Decrease -0.01 pp
From 0.70% on 04-10-2026
Known exploited
Compare KEV catalogs
CISA KEVNot in the CISA KEV catalog.
ENISA CNWNot in the ENISA CNW catalog.
CIRCLNot in the CIRCL catalog.
Public exploits
0 foundNo public exploits indexed.
Weaknesses
CWE · root cause- CWE-400Uncontrolled Resource ConsumptionThe product does not properly control the allocation and maintenance of a limited resource.
- CWE-703Improper Check or Handling of Exceptional ConditionsThe product does not properly anticipate or handle exceptional conditions that rarely occur during normal operation of the product.
- CWE-772Missing Release of Resource after Effective LifetimeThe product does not release a resource after its effective lifetime has ended, i.e., after the resource is no longer needed.
Affected systems
Known conditions: network-reachable, no authentication, no user interaction (CVSS vector). Other conditions: not stated in public data.
Chainguard3 products
- grafana-11.4All versions (No fix recorded) | < 11.4.8-r3
- grafana-11.5< 11.5.10-r2
- grafana-fips-11.5All versions (No fix recorded)
Grafana3 products
- grafanaEOL≥ 3.0.0, < 11.6.9 | ≥ 12.0.0, < 12.0.8 | ≥ 12.1.0, < 12.1.5 | ≥ 12.2.0, < 12.2.3 | 12.3.0
- grafana/grafana≥ 3.0.0, < 11.6.9 | ≥ 3.0.0, < 12.0.8 | ≥ 3.0.0, < 12.1.5 | ≥ 3.0.0, < 12.2.3 | ≥ 3.0.0, < 12.3.1
- grafana/grafana-enterprise≥ 3.0.0, < 11.6.9 | ≥ 3.0.0, < 12.0.8 | ≥ 3.0.0, < 12.1.5 | ≥ 3.0.0, < 12.2.3 | ≥ 3.0.0, < 12.3.1
Ubuntu1 product
- grafanaAll versions (No fix recorded)
3 vendors · 7 products
