{"schemaVersion":3,"id":"CVE-2026-21728","aliases":["CGA-2pfq-fm3x-x2mj","CGA-3m23-8hmf-gjf8","CGA-4mmg-jcp9-v6fv","CGA-753j-f87j-vr94","CGA-87gr-655j-j4f4","CGA-w3r4-ffm8-p6pp","GHSA-p4r4-xvrq-gvmc","GO-2026-5528","CGA-2fjv-pg8x-5553","CGA-33w3-cfc2-7fm9","CGA-3m2m-53gp-pj7c","CGA-3p69-h2vv-77fv","CGA-3wfj-prf2-6rrr","CGA-5m3c-9hx3-429p","CGA-5pmq-h388-qjg2","CGA-5wcr-v898-wp2p","CGA-626g-mch3-x4wf","CGA-6526-2pqr-58cq","CGA-66c7-4whc-65q8","CGA-884h-qc78-5jw5","CGA-8rhp-4cv8-c3rw","CGA-9742-ffxv-grfw","CGA-9r8g-424p-283p","CGA-c36x-q5pc-2pmq","CGA-cw23-r56h-wpvc","CGA-f24x-c97h-6v88","CGA-f86c-85wf-49w3","CGA-f9fv-v9hw-c8r8","CGA-fhwg-94cf-c8hm","CGA-gx7p-cg89-j2pw","CGA-hwcg-rxm7-p759","CGA-hwmq-v8h2-7vqh","CGA-j64h-2mjm-83c8","CGA-j72x-8v9j-5g39","CGA-j9w4-fhww-vg8q","CGA-m8jr-xpgf-w4pf","CGA-m8rh-85x9-8mj2","CGA-m96r-fcqc-pgvg","CGA-p2gf-63rj-f7j4","CGA-p6cp-xvxw-g5m5","CGA-pcwq-cpgp-cxm5","CGA-pxg5-qxhw-gg6w","CGA-q752-j9cq-j8m9","CGA-qfhw-rrcw-jxm2","CGA-r47v-h538-g8v5","CGA-r9xh-7927-m26c","CGA-rfpw-ch7h-q3vm","CGA-rq2f-4ghh-2w5w","CGA-v5mp-8v5m-ccqm","CGA-v67j-r249-j67m","CGA-vww6-mwmr-4vm8","CGA-w3f6-3jg4-j9j2","CGA-w9v7-7qrr-4986","CGA-wmhg-9jcr-xqwr","CGA-x565-qc36-26x5","CGA-x6p5-c982-9gw3","CGA-x867-phh2-fr33"],"status":"published","duplicateOf":null,"title":null,"description":"Tempo queries with large limits can cause large memory allocations which can impact the availability of the service, depending on its deployment strategy.\n\nMitigation can be done by setting max_result_limit in the search config, e.g. to 262144 (2^18). Alternatively, automatically restart the service.","dates":{"published":"2026-04-24T08:00:47.074Z","modified":"2026-09-09T12:04:42.986Z","reserved":null,"kevAdded":[],"kevDue":[]},"cvss":{"headline":{"score":7.5,"severity":"high","version":"3.1","versionLabel":"v3.1","source":"CVE.org","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","computed":false,"selection":"backend-summary"},"metrics":[{"version":"3.1","versionLabel":"v3.1","source":"CVE.org","score":7.5,"severity":"high","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","exploitability":null,"impact":null,"computed":false},{"version":"3.1","versionLabel":"v3.1","source":"OSV · Wolfi","score":7.5,"severity":"high","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","exploitability":10,"impact":6,"computed":true},{"version":"3.1","versionLabel":"v3.1","source":"OSV · Go","score":7.5,"severity":"high","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","exploitability":10,"impact":6,"computed":true},{"version":"3.1","versionLabel":"v3.1","source":"OSV · Chainguard","score":7.5,"severity":"high","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","exploitability":10,"impact":6,"computed":true},{"version":"3.1","versionLabel":"v3.1","source":"NVD","score":7.5,"severity":"high","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","exploitability":null,"impact":null,"computed":false}]},"epss":{"probability":0.00637,"percentile":0.49592,"severity":"low","asOf":"2026-10-20T00:00:00.000Z","change":{"pp":0,"baselineDate":"2026-09-20T00:00:00.000Z","baselineScore":0.00637},"history":[{"date":"2026-09-14T00:00:00.000Z","score":0.00637,"percentile":null},{"date":"2026-09-15T00:00:00.000Z","score":0.00637,"percentile":null},{"date":"2026-09-16T00:00:00.000Z","score":0.00637,"percentile":null},{"date":"2026-09-17T00:00:00.000Z","score":0.00637,"percentile":null},{"date":"2026-09-18T00:00:00.000Z","score":0.00637,"percentile":null},{"date":"2026-09-19T00:00:00.000Z","score":0.00637,"percentile":null},{"date":"2026-09-20T00:00:00.000Z","score":0.00637,"percentile":null},{"date":"2026-09-21T00:00:00.000Z","score":0.00637,"percentile":null},{"date":"2026-09-22T00:00:00.000Z","score":0.00637,"percentile":null},{"date":"2026-09-23T00:00:00.000Z","score":0.00637,"percentile":null},{"date":"2026-09-24T00:00:00.000Z","score":0.00637,"percentile":null},{"date":"2026-09-25T00:00:00.000Z","score":0.00637,"percentile":null},{"date":"2026-09-26T00:00:00.000Z","score":0.00637,"percentile":null},{"date":"2026-09-27T00:00:00.000Z","score":0.00637,"percentile":null},{"date":"2026-09-28T00:00:00.000Z","score":0.00637,"percentile":null},{"date":"2026-09-29T00:00:00.000Z","score":0.00637,"percentile":null},{"date":"2026-09-30T00:00:00.000Z","score":0.00637,"percentile":null},{"date":"2026-10-01T00:00:00.000Z","score":0.00637,"percentile":null},{"date":"2026-10-02T00:00:00.000Z","score":0.00637,"percentile":null},{"date":"2026-10-03T00:00:00.000Z","score":0.00637,"percentile":null},{"date":"2026-10-04T00:00:00.000Z","score":0.00637,"percentile":null},{"date":"2026-10-05T00:00:00.000Z","score":0.00637,"percentile":null},{"date":"2026-10-06T00:00:00.000Z","score":0.00637,"percentile":null},{"date":"2026-10-07T00:00:00.000Z","score":0.00637,"percentile":null},{"date":"2026-10-08T00:00:00.000Z","score":0.00637,"percentile":null},{"date":"2026-10-09T00:00:00.000Z","score":0.00637,"percentile":null},{"date":"2026-10-10T00:00:00.000Z","score":0.00637,"percentile":null},{"date":"2026-10-11T00:00:00.000Z","score":0.00637,"percentile":null},{"date":"2026-10-12T00:00:00.000Z","score":0.00637,"percentile":null},{"date":"2026-10-13T00:00:00.000Z","score":0.00637,"percentile":null},{"date":"2026-10-14T00:00:00.000Z","score":0.00637,"percentile":null},{"date":"2026-10-15T00:00:00.000Z","score":0.00637,"percentile":null},{"date":"2026-10-16T00:00:00.000Z","score":0.00637,"percentile":null},{"date":"2026-10-17T00:00:00.000Z","score":0.00637,"percentile":null},{"date":"2026-10-18T00:00:00.000Z","score":0.00637,"percentile":null},{"date":"2026-10-19T00:00:00.000Z","score":0.00637,"percentile":null},{"date":"2026-10-20T00:00:00.000Z","score":0.00637,"percentile":0.49592}],"last30":[{"date":"2026-09-20T00:00:00.000Z","score":0.00637,"percentile":null},{"date":"2026-09-21T00:00:00.000Z","score":0.00637,"percentile":null},{"date":"2026-09-22T00:00:00.000Z","score":0.00637,"percentile":null},{"date":"2026-09-23T00:00:00.000Z","score":0.00637,"percentile":null},{"date":"2026-09-24T00:00:00.000Z","score":0.00637,"percentile":null},{"date":"2026-09-25T00:00:00.000Z","score":0.00637,"percentile":null},{"date":"2026-09-26T00:00:00.000Z","score":0.00637,"percentile":null},{"date":"2026-09-27T00:00:00.000Z","score":0.00637,"percentile":null},{"date":"2026-09-28T00:00:00.000Z","score":0.00637,"percentile":null},{"date":"2026-09-29T00:00:00.000Z","score":0.00637,"percentile":null},{"date":"2026-09-30T00:00:00.000Z","score":0.00637,"percentile":null},{"date":"2026-10-01T00:00:00.000Z","score":0.00637,"percentile":null},{"date":"2026-10-02T00:00:00.000Z","score":0.00637,"percentile":null},{"date":"2026-10-03T00:00:00.000Z","score":0.00637,"percentile":null},{"date":"2026-10-04T00:00:00.000Z","score":0.00637,"percentile":null},{"date":"2026-10-05T00:00:00.000Z","score":0.00637,"percentile":null},{"date":"2026-10-06T00:00:00.000Z","score":0.00637,"percentile":null},{"date":"2026-10-07T00:00:00.000Z","score":0.00637,"percentile":null},{"date":"2026-10-08T00:00:00.000Z","score":0.00637,"percentile":null},{"date":"2026-10-09T00:00:00.000Z","score":0.00637,"percentile":null},{"date":"2026-10-10T00:00:00.000Z","score":0.00637,"percentile":null},{"date":"2026-10-11T00:00:00.000Z","score":0.00637,"percentile":null},{"date":"2026-10-12T00:00:00.000Z","score":0.00637,"percentile":null},{"date":"2026-10-13T00:00:00.000Z","score":0.00637,"percentile":null},{"date":"2026-10-14T00:00:00.000Z","score":0.00637,"percentile":null},{"date":"2026-10-15T00:00:00.000Z","score":0.00637,"percentile":null},{"date":"2026-10-16T00:00:00.000Z","score":0.00637,"percentile":null},{"date":"2026-10-17T00:00:00.000Z","score":0.00637,"percentile":null},{"date":"2026-10-18T00:00:00.000Z","score":0.00637,"percentile":null},{"date":"2026-10-19T00:00:00.000Z","score":0.00637,"percentile":null},{"date":"2026-10-20T00:00:00.000Z","score":0.00637,"percentile":0.49592}]},"kev":{"state":"not-listed","entries":[],"listedCount":0,"totalCatalogs":3,"catalogs":[{"source":"cisa","label":"CISA","listed":false,"entry":null},{"source":"enisa","label":"ENISA","listed":false,"entry":null},{"source":"circl","label":"CIRCL","listed":false,"entry":null}]},"ransomware":{"state":"none-recorded","sources":[]},"exploits":[],"exploitCount":0,"weaknesses":[{"id":"CWE-400","name":"Uncontrolled Resource Consumption","description":"The product does not properly control the allocation and maintenance of a limited resource.","type":"weakness","status":"Draft","abstraction":"Class","likelihoodOfExploit":"High","url":"https://cwe.mitre.org/data/definitions/400.html"},{"id":"CWE-770","name":"Allocation of Resources Without Limits or Throttling","description":"The product allocates a reusable resource or group of resources on behalf of an actor without imposing any intended restrictions on the size or number of resources that can be allocated.","type":"weakness","status":"Incomplete","abstraction":"Base","likelihoodOfExploit":"High","url":"https://cwe.mitre.org/data/definitions/770.html"}],"affected":[{"vendor":"chainguard","product":"commercial-grafana-11.6","name":"commercial-grafana-11.6","label":"commercial-grafana-11.6","ecosystem":"Chainguard","cpePart":null,"purl":"pkg:apk/chainguard/commercial-grafana-11.6","purlType":"apk","versions":[{"text":"All versions","noFixRecorded":true,"fixedIn":null}],"versionsText":"All versions (No fix recorded)","eol":null,"hubHref":null},{"vendor":"chainguard","product":"commercial-grafana-12.1","name":"commercial-grafana-12.1","label":"commercial-grafana-12.1","ecosystem":"Chainguard","cpePart":null,"purl":"pkg:apk/chainguard/commercial-grafana-12.1","purlType":"apk","versions":[{"text":"All versions","noFixRecorded":true,"fixedIn":null}],"versionsText":"All versions (No fix recorded)","eol":null,"hubHref":null},{"vendor":"chainguard","product":"commercial-grafana-12.2","name":"commercial-grafana-12.2","label":"commercial-grafana-12.2","ecosystem":"Chainguard","cpePart":null,"purl":"pkg:apk/chainguard/commercial-grafana-12.2","purlType":"apk","versions":[{"text":"All versions","noFixRecorded":true,"fixedIn":null}],"versionsText":"All versions (No fix recorded)","eol":null,"hubHref":null},{"vendor":"chainguard","product":"commercial-grafana-12.3","name":"commercial-grafana-12.3","label":"commercial-grafana-12.3","ecosystem":"Chainguard","cpePart":null,"purl":"pkg:apk/chainguard/commercial-grafana-12.3","purlType":"apk","versions":[{"text":"All versions","noFixRecorded":true,"fixedIn":null}],"versionsText":"All versions (No fix recorded)","eol":null,"hubHref":null},{"vendor":"chainguard","product":"commercial-grafana-12.4","name":"commercial-grafana-12.4","label":"commercial-grafana-12.4","ecosystem":"Chainguard","cpePart":null,"purl":"pkg:apk/chainguard/commercial-grafana-12.4","purlType":"apk","versions":[{"text":"All versions","noFixRecorded":true,"fixedIn":null}],"versionsText":"All versions (No fix recorded)","eol":null,"hubHref":null},{"vendor":"chainguard","product":"commercial-grafana-13.0","name":"commercial-grafana-13.0","label":"commercial-grafana-13.0","ecosystem":"Chainguard","cpePart":null,"purl":"pkg:apk/chainguard/commercial-grafana-13.0","purlType":"apk","versions":[{"text":"All versions","noFixRecorded":true,"fixedIn":null}],"versionsText":"All versions (No fix recorded)","eol":null,"hubHref":null},{"vendor":"chainguard","product":"commercial-grafana-13.1","name":"commercial-grafana-13.1","label":"commercial-grafana-13.1","ecosystem":"Chainguard","cpePart":null,"purl":"pkg:apk/chainguard/commercial-grafana-13.1","purlType":"apk","versions":[{"text":"All versions","noFixRecorded":true,"fixedIn":null}],"versionsText":"All versions (No fix recorded)","eol":null,"hubHref":null},{"vendor":"chainguard","product":"commercial-grafana-13.2","name":"commercial-grafana-13.2","label":"commercial-grafana-13.2","ecosystem":"Chainguard","cpePart":null,"purl":"pkg:apk/chainguard/commercial-grafana-13.2","purlType":"apk","versions":[{"text":"All versions","noFixRecorded":true,"fixedIn":null}],"versionsText":"All versions (No fix recorded)","eol":null,"hubHref":null},{"vendor":"chainguard","product":"grafana-11.6","name":"grafana-11.6","label":"grafana-11.6","ecosystem":"Chainguard","cpePart":null,"purl":"pkg:apk/chainguard/grafana-11.6","purlType":"apk","versions":[{"text":"All versions","noFixRecorded":true,"fixedIn":null}],"versionsText":"All versions (No fix recorded)","eol":null,"hubHref":null},{"vendor":"chainguard","product":"grafana-12.0","name":"grafana-12.0","label":"grafana-12.0","ecosystem":"Chainguard","cpePart":null,"purl":"pkg:apk/chainguard/grafana-12.0","purlType":"apk","versions":[{"text":"All versions","noFixRecorded":true,"fixedIn":null}],"versionsText":"All versions (No fix recorded)","eol":null,"hubHref":null},{"vendor":"chainguard","product":"grafana-12.1","name":"grafana-12.1","label":"grafana-12.1","ecosystem":"Chainguard","cpePart":null,"purl":"pkg:apk/chainguard/grafana-12.1","purlType":"apk","versions":[{"text":"All versions","noFixRecorded":true,"fixedIn":null}],"versionsText":"All versions (No fix recorded)","eol":null,"hubHref":null},{"vendor":"chainguard","product":"grafana-12.2","name":"grafana-12.2","label":"grafana-12.2","ecosystem":"Chainguard","cpePart":null,"purl":"pkg:apk/chainguard/grafana-12.2","purlType":"apk","versions":[{"text":"All versions","noFixRecorded":true,"fixedIn":null}],"versionsText":"All versions (No fix recorded)","eol":null,"hubHref":null},{"vendor":"chainguard","product":"grafana-12.3","name":"grafana-12.3","label":"grafana-12.3","ecosystem":"Chainguard","cpePart":null,"purl":"pkg:apk/chainguard/grafana-12.3","purlType":"apk","versions":[{"text":"All versions","noFixRecorded":true,"fixedIn":null}],"versionsText":"All versions (No fix recorded)","eol":null,"hubHref":null},{"vendor":"chainguard","product":"grafana-12.4","name":"grafana-12.4","label":"grafana-12.4","ecosystem":"Chainguard","cpePart":null,"purl":"pkg:apk/chainguard/grafana-12.4","purlType":"apk","versions":[{"text":"All versions","noFixRecorded":true,"fixedIn":null}],"versionsText":"All versions (No fix recorded)","eol":null,"hubHref":null},{"vendor":"chainguard","product":"grafana-13.0","name":"grafana-13.0","label":"grafana-13.0","ecosystem":"Chainguard","cpePart":null,"purl":"pkg:apk/chainguard/grafana-13.0","purlType":"apk","versions":[{"text":"All versions","noFixRecorded":true,"fixedIn":null}],"versionsText":"All versions (No fix recorded)","eol":null,"hubHref":null},{"vendor":"chainguard","product":"grafana-13.1","name":"grafana-13.1","label":"grafana-13.1","ecosystem":"Chainguard","cpePart":null,"purl":"pkg:apk/chainguard/grafana-13.1","purlType":"apk","versions":[{"text":"All versions","noFixRecorded":true,"fixedIn":null}],"versionsText":"All versions (No fix recorded)","eol":null,"hubHref":null},{"vendor":"chainguard","product":"grafana-fips-11.6","name":"grafana-fips-11.6","label":"grafana-fips-11.6","ecosystem":"Chainguard","cpePart":null,"purl":"pkg:apk/chainguard/grafana-fips-11.6","purlType":"apk","versions":[{"text":"All versions","noFixRecorded":true,"fixedIn":null}],"versionsText":"All versions (No fix recorded)","eol":null,"hubHref":null},{"vendor":"chainguard","product":"grafana-fips-12.0","name":"grafana-fips-12.0","label":"grafana-fips-12.0","ecosystem":"Chainguard","cpePart":null,"purl":"pkg:apk/chainguard/grafana-fips-12.0","purlType":"apk","versions":[{"text":"All versions","noFixRecorded":true,"fixedIn":null}],"versionsText":"All versions (No fix recorded)","eol":null,"hubHref":null},{"vendor":"chainguard","product":"grafana-fips-12.1","name":"grafana-fips-12.1","label":"grafana-fips-12.1","ecosystem":"Chainguard","cpePart":null,"purl":"pkg:apk/chainguard/grafana-fips-12.1","purlType":"apk","versions":[{"text":"All versions","noFixRecorded":true,"fixedIn":null}],"versionsText":"All versions (No fix recorded)","eol":null,"hubHref":null},{"vendor":"chainguard","product":"grafana-fips-12.2","name":"grafana-fips-12.2","label":"grafana-fips-12.2","ecosystem":"Chainguard","cpePart":null,"purl":"pkg:apk/chainguard/grafana-fips-12.2","purlType":"apk","versions":[{"text":"< 12.2.8.01-r3","noFixRecorded":false,"fixedIn":null}],"versionsText":"< 12.2.8.01-r3","eol":null,"hubHref":null},{"vendor":"chainguard","product":"grafana-fips-12.3","name":"grafana-fips-12.3","label":"grafana-fips-12.3","ecosystem":"Chainguard","cpePart":null,"purl":"pkg:apk/chainguard/grafana-fips-12.3","purlType":"apk","versions":[{"text":"All versions","noFixRecorded":true,"fixedIn":null}],"versionsText":"All versions (No fix recorded)","eol":null,"hubHref":null},{"vendor":"chainguard","product":"grafana-fips-12.4","name":"grafana-fips-12.4","label":"grafana-fips-12.4","ecosystem":"Chainguard","cpePart":null,"purl":"pkg:apk/chainguard/grafana-fips-12.4","purlType":"apk","versions":[{"text":"All versions","noFixRecorded":true,"fixedIn":null}],"versionsText":"All versions (No fix recorded)","eol":null,"hubHref":null},{"vendor":"chainguard","product":"grafana-fips-13.0","name":"grafana-fips-13.0","label":"grafana-fips-13.0","ecosystem":"Chainguard","cpePart":null,"purl":"pkg:apk/chainguard/grafana-fips-13.0","purlType":"apk","versions":[{"text":"All versions","noFixRecorded":true,"fixedIn":null}],"versionsText":"All versions (No fix recorded)","eol":null,"hubHref":null},{"vendor":"chainguard","product":"grafana-fips-13.1","name":"grafana-fips-13.1","label":"grafana-fips-13.1","ecosystem":"Chainguard","cpePart":null,"purl":"pkg:apk/chainguard/grafana-fips-13.1","purlType":"apk","versions":[{"text":"All versions","noFixRecorded":true,"fixedIn":null}],"versionsText":"All versions (No fix recorded)","eol":null,"hubHref":null},{"vendor":"chainguard","product":"grafana-geomys-fips-13.1","name":"grafana-geomys-fips-13.1","label":"grafana-geomys-fips-13.1","ecosystem":"Chainguard","cpePart":null,"purl":"pkg:apk/chainguard/grafana-geomys-fips-13.1","purlType":"apk","versions":[{"text":"All versions","noFixRecorded":true,"fixedIn":null}],"versionsText":"All versions (No fix recorded)","eol":null,"hubHref":null},{"vendor":"chainguard","product":"grafana-tempo-datasource","name":"grafana-tempo-datasource","label":"grafana-tempo-datasource","ecosystem":"Chainguard","cpePart":null,"purl":"pkg:apk/chainguard/grafana-tempo-datasource","purlType":"apk","versions":[{"text":"All versions","noFixRecorded":true,"fixedIn":null}],"versionsText":"All versions (No fix recorded)","eol":null,"hubHref":null},{"vendor":"chainguard","product":"grafana-tempo-datasource-fips","name":"grafana-tempo-datasource-fips","label":"grafana-tempo-datasource-fips","ecosystem":"Chainguard","cpePart":null,"purl":"pkg:apk/chainguard/grafana-tempo-datasource-fips","purlType":"apk","versions":[{"text":"All versions","noFixRecorded":true,"fixedIn":null}],"versionsText":"All versions (No fix recorded)","eol":null,"hubHref":null},{"vendor":"chainguard","product":"percona-grafana","name":"percona-grafana","label":"percona-grafana","ecosystem":"Chainguard","cpePart":null,"purl":"pkg:apk/chainguard/percona-grafana","purlType":"apk","versions":[{"text":"All versions","noFixRecorded":true,"fixedIn":null}],"versionsText":"All versions (No fix recorded)","eol":null,"hubHref":null},{"vendor":"wolfi","product":"grafana-12.3","name":"grafana-12.3","label":"grafana-12.3","ecosystem":"Wolfi","cpePart":null,"purl":"pkg:apk/wolfi/grafana-12.3","purlType":"apk","versions":[{"text":"All versions","noFixRecorded":true,"fixedIn":null}],"versionsText":"All versions (No fix recorded)","eol":null,"hubHref":null},{"vendor":"wolfi","product":"grafana-12.4","name":"grafana-12.4","label":"grafana-12.4","ecosystem":"Wolfi","cpePart":null,"purl":"pkg:apk/wolfi/grafana-12.4","purlType":"apk","versions":[{"text":"All versions","noFixRecorded":true,"fixedIn":null}],"versionsText":"All versions (No fix recorded)","eol":null,"hubHref":null},{"vendor":"wolfi","product":"grafana-13.0","name":"grafana-13.0","label":"grafana-13.0","ecosystem":"Wolfi","cpePart":null,"purl":"pkg:apk/wolfi/grafana-13.0","purlType":"apk","versions":[{"text":"All versions","noFixRecorded":true,"fixedIn":null}],"versionsText":"All versions (No fix recorded)","eol":null,"hubHref":null},{"vendor":"github.com/grafana","product":"tempo","name":"github.com/grafana/tempo","label":"tempo","ecosystem":"Go","cpePart":null,"purl":"pkg:golang/github.com/grafana/tempo","purlType":"golang","versions":[{"text":"≥ 1.3.0, < 2.8.4","noFixRecorded":false,"fixedIn":null},{"text":"≥ 2.9.0, < 2.9.2","noFixRecorded":false,"fixedIn":null},{"text":"≥ 2.10.0, < 2.10.2","noFixRecorded":false,"fixedIn":null},{"text":"≥ 1.3.0","noFixRecorded":true,"fixedIn":null}],"versionsText":"≥ 1.3.0, < 2.8.4 | ≥ 2.9.0, < 2.9.2 | ≥ 2.10.0, < 2.10.2 | ≥ 1.3.0 (No fix recorded)","eol":null,"hubHref":null},{"vendor":"grafana","product":"enterprise traces (get)","name":"Enterprise Traces (GET)","label":"enterprise traces (get)","ecosystem":null,"cpePart":"a","purl":null,"purlType":null,"versions":[{"text":"≥ 1.0.0, ≤ 2.8.7","noFixRecorded":false,"fixedIn":null}],"versionsText":"≥ 1.0.0, ≤ 2.8.7","eol":null,"hubHref":"/vendor/grafana/enterprise_traces_get"},{"vendor":"grafana","product":"tempo","name":"tempo","label":"tempo","ecosystem":null,"cpePart":"a","purl":null,"purlType":null,"versions":[{"text":"≥ 1.3.0, ≤ 2.8.3","noFixRecorded":false,"fixedIn":null},{"text":"≥ 2.9.0, ≤ 2.9.1","noFixRecorded":false,"fixedIn":null},{"text":"≥ 2.10.0, ≤ 2.10.1","noFixRecorded":false,"fixedIn":null},{"text":"≥ 1.3.0, < 2.8.4","noFixRecorded":false,"fixedIn":null},{"text":"≥ 2.9.0, < 2.9.2","noFixRecorded":false,"fixedIn":null},{"text":"≥ 2.10.0, < 2.10.2","noFixRecorded":false,"fixedIn":null}],"versionsText":"≥ 1.3.0, ≤ 2.8.3 | ≥ 2.9.0, ≤ 2.9.1 | ≥ 2.10.0, ≤ 2.10.1 | ≥ 1.3.0, < 2.8.4 | ≥ 2.9.0, < 2.9.2 | ≥ 2.10.0, < 2.10.2","eol":null,"hubHref":"/vendor/grafana/tempo"}],"affectedCount":34,"eol":{"hasEol":false,"count":0},"references":[{"url":"https://grafana.com/security/security-advisories/cve-2026-21728","label":"grafana.com/security/security-advisories/cve-2026-21728","hostname":"grafana.com","tags":["Vendor Advisory","Advisory","WEB","Broken Link"]},{"url":"https://access.redhat.com/security/cve/CVE-2026-21728","label":"access.redhat.com/security/cve/CVE-2026-21728","hostname":"access.redhat.com","tags":["VDB Entry","X Refsource REDHAT","Advisory"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2461395","label":"bugzilla.redhat.com/show_bug.cgi?id=2461395","hostname":"bugzilla.redhat.com","tags":["Issue Tracking","X Refsource REDHAT","REPORT"]},{"url":"https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-21728.json","label":"security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-21728.json","hostname":"security.access.redhat.com","tags":["X Sadp Csaf Vex","WEB"]},{"url":"https://access.redhat.com/errata/RHSA-2026:22423","label":"access.redhat.com/errata/RHSA-2026:22423","hostname":"access.redhat.com","tags":["Vendor Advisory","X Refsource REDHAT","Advisory"]},{"url":"https://access.redhat.com/errata/RHSA-2026:22347","label":"access.redhat.com/errata/RHSA-2026:22347","hostname":"access.redhat.com","tags":["Vendor Advisory","X Refsource REDHAT","Advisory"]},{"url":"https://access.redhat.com/errata/RHSA-2026:23345","label":"access.redhat.com/errata/RHSA-2026:23345","hostname":"access.redhat.com","tags":["Vendor Advisory","X Refsource REDHAT","Advisory"]},{"url":"https://access.redhat.com/errata/RHSA-2026:24503","label":"access.redhat.com/errata/RHSA-2026:24503","hostname":"access.redhat.com","tags":["Vendor Advisory","X Refsource REDHAT","Advisory"]},{"url":"https://access.redhat.com/errata/RHSA-2026:21769","label":"access.redhat.com/errata/RHSA-2026:21769","hostname":"access.redhat.com","tags":["Vendor Advisory","X Refsource REDHAT","Advisory"]},{"url":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/21xxx/CVE-2026-21728.json","label":"github.com/CVEProject/cvelistV5/tree/main/cves/2026/21xxx/CVE-2026-21728.json","hostname":"github.com","tags":["Advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-21728","label":"nvd.nist.gov/vuln/detail/CVE-2026-21728","hostname":"nvd.nist.gov","tags":["Advisory"]},{"url":"https://github.com/grafana/tempo/pull/6525","label":"github.com/grafana/tempo/pull/6525","hostname":"github.com","tags":["WEB","FIX"]},{"url":"https://github.com/grafana/tempo/commit/650eb1985a0776789c8564122990f588a742356f","label":"github.com/grafana/tempo/commit/650eb1985a0776789c8564122990f588a742356f","hostname":"github.com","tags":["WEB","FIX"]},{"url":"https://github.com/grafana/tempo","label":"github.com/grafana/tempo","hostname":"github.com","tags":["PACKAGE"]},{"url":"https://github.com/grafana/tempo/blob/4dc3e5b0d3463a0b67498b662b85a148698b4afd/docs/sources/tempo/release-notes/version-2/v2-10.md?plain=1#L328","label":"github.com/grafana/…","hostname":"github.com","tags":["WEB"]},{"url":"https://github.com/grafana/tempo/blob/4dc3e5b0d3463a0b67498b662b85a148698b4afd/docs/sources/tempo/release-notes/version-2/v2-8.md?plain=1#L251","label":"github.com/grafana/…","hostname":"github.com","tags":["WEB"]},{"url":"https://github.com/grafana/tempo/blob/4dc3e5b0d3463a0b67498b662b85a148698b4afd/docs/sources/tempo/release-notes/version-2/v2-9.md?plain=1#L224","label":"github.com/grafana/…","hostname":"github.com","tags":["WEB"]},{"url":"https://github.com/advisories/GHSA-p4r4-xvrq-gvmc","label":"github.com/advisories/GHSA-p4r4-xvrq-gvmc","hostname":"github.com","tags":["Advisory"]}],"lineage":{"upstream":[],"downstream":["OPENSUSE-SU-2026:21483-1"],"duplicates":[],"related":["CGA-CHWC-RC6R-V5HF","OPENSUSE-SU-2026:21483-1"]},"timeline":[{"kind":"published","date":"2026-04-24T08:00:47.074Z","label":"Published","detail":"Vulnerability first disclosed.","source":null},{"kind":"modified","date":"2026-09-09T12:04:42.986Z","label":"Last modified","detail":"Vulnerability information updated.","source":null}],"risk":{"score":30,"level":"medium","profile":"Default","thresholds":{"critical":75,"high":50,"medium":25,"low":10}},"meta":{"dataAsOf":"2026-10-20T22:47:11.183Z","stale":false,"partial":false}}