CVE-2026-27879: Query resampling can cause unbounded memory allocations
Analyzed
AliasesUBUNTU-CVE-2026-27879CGA-3xg3-fvpq-68vgCGA-7vpw-mr9g-4499CGA-7wfg-rwv2-f82wCGA-9qwh-fvgx-2h6rCGA-ffgv-w5j6-22mpCGA-q9xp-2j63-rj95CGA-r3f5-jfqg-mpmwCGA-wwv3-4xw6-ww6gCGA-24h9-xj3x-9vfcCGA-2r7m-wc6p-522rCGA-2vxv-gx53-vcwcCGA-37vc-5c6c-4jffCGA-44fx-57j5-wqvhCGA-462m-pcqp-hp9pCGA-476v-j6wh-j6wjCGA-48c7-w98h-c98jCGA-4q7c-rcm3-86phCGA-5ffr-f8j6-xgcgCGA-5hfr-7f87-vqggCGA-5rjw-xm63-232cCGA-5whx-65q6-r4r3CGA-62v6-8f88-9p5pCGA-6c9p-8x9f-x568CGA-6fww-8g63-2gwmCGA-72jh-p99r-cqqcCGA-72xm-689c-frmxCGA-75ph-fjxh-q9pvCGA-7cmm-w8vj-x84xCGA-7hg6-5m6x-4wqpCGA-7v52-5r7p-6vrfCGA-7xqh-72vc-9vxfCGA-8f4g-9wj3-g3rjCGA-8g47-x24p-cqvvCGA-8x28-xp97-66m8CGA-9g5q-84x8-27m8CGA-9m5g-8w93-c5gwCGA-9v8r-v9fw-4gqjCGA-9w22-98gf-4wh5CGA-9w8f-wxcw-3433CGA-c374-p6fp-pqf9CGA-c4qp-f6v3-wprwCGA-cfmv-w8hw-9fj8CGA-cq8q-j7g6-f4r2CGA-f2qj-hxpm-pqhgCGA-fch6-9rhg-f39jCGA-fhr2-99mm-x6pmCGA-fjwm-2g2h-vq97CGA-frmm-888c-4cxgCGA-fwc2-q94g-fc7mCGA-g4xr-xxqw-7jmcCGA-g62q-pcgx-qq6rCGA-g78f-cfc3-vmx8CGA-ggwc-qh2x-mv2xCGA-gh2v-pjhf-6wfcCGA-grjx-vhx9-pgg4CGA-gxxx-x724-vm2vCGA-h3q3-f85r-264fCGA-h5w8-rww5-8c8vCGA-hmmr-6p6m-2fcxCGA-hp9h-qq2w-pfp9CGA-m5cc-jcwm-3j5qCGA-m6hc-66cf-xr7wCGA-m7q4-gx4v-3chwCGA-mc7v-vjgp-6mp9CGA-p542-pf9h-ww2gCGA-q432-ppw3-qh33CGA-q8jr-gp2p-rvxpCGA-qgwp-3862-6mf4CGA-qxf5-7wfg-rv86CGA-qxr2-v8rh-5r65CGA-r859-fg7q-wq3cCGA-r8f6-3xrq-j45fCGA-rpgw-467c-rhgpCGA-v628-qpxw-4x36CGA-v69r-444r-3rffCGA-v94m-qj77-7xxvCGA-vqfr-xx97-gm2hCGA-vvhr-2jgf-wmjwCGA-wj65-j2r3-m5rmCGA-x6vc-vfmx-7qw6CGA-xf7c-rp3f-xpq3CGA-xgh7-hrff-5f43CGA-xm92-p3mv-fp8mCGA-xq55-g8cg-wxh3ALPINE-CVE-2026-27879
Published 27-03-2026Last modified 27-08-2026
Vulnerability summary
CVE-2026-27879 is a medium (CVSS 6.5) Out-of-bounds Write vulnerability in grafana. EPSS estimates a 0.39% chance of exploitation in the next 30 days, higher than 33.2% of scored vulnerabilities.
Priority
Routine
Not severe (CVSS 6.5, network access); no exploitation reported by the 5 checked sources
Source freshness unavailable
How is this decided?CVSS score
6.5/10
010
Medium · v3.1 (CVE.org)EPSS score
0.39%
0%100%
Low · -0.03 pp in 30 daysKEVNot listedNot listed by any tracked catalog.
RansomwareNot flaggedNo ransomware use recorded.
Public exploits0No public exploits recorded
Advisory lineage
Upstream 0 · Downstream 3 · Related 4Timeline
- 27-03-2026PublishedVulnerability first disclosed.
- 27-08-2026Last modifiedVulnerability information updated.
Description
A resample query can be used to trigger out-of-memory crashes in Grafana.
CVSS metrics
6 scores · 6 sources · 1 versionMedium 6.5Preferred score · CVE.org (CNA)
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:HSourcesAll 6 agree
- OSV · UbuntuEcosystem advisory · calculated6.5MediumCVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H
- OSV · WolfiEcosystem advisory · calculated6.5MediumCVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H
- OSV · ChainguardEcosystem advisory · calculated6.5MediumCVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H
- NVDNIST6.5MediumCVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H
- OSV · AlpineEcosystem advisory · calculated6.5MediumCVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H
EPSS trend
Probability
0.39%
Chance of exploitation in the next 30 days
Percentile
33%
Versus all other CVEs
30-day change
Decrease -0.03 pp
From 0.42% on 04-10-2026
04-10-202603-11-2026
Known exploited
Compare KEV catalogs
CISA KEVNot in the CISA KEV catalog.
ENISA CNWNot in the ENISA CNW catalog.
CIRCLNot in the CIRCL catalog.
Public exploits
0 foundNo public exploits indexed.
Weaknesses
CWE · root causeAffected systems
Version check
Known conditions: network-reachable, low-privilege account, no user interaction (CVSS vector). Other conditions: not stated in public data.
Chainguard12 products
- grafana-11.5All versions (No fix recorded)
- grafana-11.6All versions (No fix recorded)
- grafana-12.0All versions (No fix recorded)
- grafana-12.1All versions (No fix recorded)
- grafana-12.2All versions (No fix recorded)
Alpine1 product
- grafana≥ 11.6.14, < 12.2.8-r0 | ≥ 11.6.14, < 12.4.3-r0
Grafana1 product
- grafana≥ 8.0.0, < 11.6.14 | ≥ 12.0.0, < 12.1.10 | ≥ 12.2.0, < 12.2.8 | ≥ 12.3.0, < 12.3.6 | ≥ 12.4.0, < 12.4.2 | < 8.0.0 | ≥ 11.6.14, < 12.0.0 | ≥ 12.1.10, < 12.2.0 | ≥ 12.2.8, < 12.3.0 | ≥ 12.3.6, < 12.4.0
Ubuntu1 product
- grafanaAll versions (No fix recorded)
Wolfi1 product
- grafana-12.3All versions (No fix recorded)
5 vendors · 16 products
