CVE-2026-33378: grafana Uncontrolled Resource Consumption
CVSS: 6.5v3.1MediumAnalyzed
AliasesUBUNTU-CVE-2026-33378CGA-5v8m-pch5-qw42CGA-cr3p-h94w-2mphCGA-f8jg-78m2-g63qCGA-fcrc-9xq6-4mmwCGA-p87p-267v-8pwpCGA-x26g-h2r5-3r8jCGA-x2j6-ccvv-8fg8CGA-xpj7-38rr-2f9vCGA-3cvj-3f4f-q7rvCGA-3vvr-hmg3-x2x8CGA-526j-xfvp-gwqjCGA-62p3-6jc8-6cqgCGA-663w-jp98-h577CGA-6fvc-9j2h-6737CGA-6mq2-p439-78v2CGA-6qgp-cwgw-fxj4CGA-74hv-4h2g-8frqCGA-74j5-g25w-2mvpCGA-7g22-cf28-c7wpCGA-888w-xcpw-4g2xCGA-8gcr-8hhc-3rf9CGA-8jv8-5x48-pv67CGA-9357-vqg7-24c6CGA-96w2-hm5m-xv68CGA-c675-55w9-29qqCGA-c8g9-7w25-v96gCGA-cqxj-29f3-fxphCGA-f3q5-gwrw-427gCGA-f66r-rvwx-f6ppCGA-fcvh-mp8g-v2fgCGA-fg53-x4m5-2pcrCGA-fmpf-8p44-xv6mCGA-hw22-8vv3-64pvCGA-jjp9-pr6m-62hwCGA-jvp9-78j2-3m2rCGA-mc2r-wg2m-fg52CGA-pg2q-5jvr-7m34CGA-q5rh-r6m2-p2h9CGA-q98j-7q2h-rj67CGA-wq8q-8635-c639CGA-wx32-cg8x-pvjrCGA-xgh3-w7h7-wprm
Published 13-05-2026Last modified 27-08-2026
Vulnerability summary
CVE-2026-33378 is a medium (CVSS 6.5) Uncontrolled Resource Consumption vulnerability in grafana. EPSS estimates a 0.33% chance of exploitation in the next 30 days, higher than 24.6% of scored vulnerabilities.
CVSS score
6.5/10
010
Medium · v3.1 (CVE.org)EPSS score
0.33%
0%100%
Low · 0.00 pp in 30 daysKEVNot listedIn no KEV catalog
RansomwareNone recordedNo known use recorded
Public exploits0No public exploits recorded
Advisory lineage
Upstream 0 · Downstream 8 · Related 6Timeline
- 13-05-2026PublishedVulnerability first disclosed.
- 27-08-2026Last modifiedVulnerability information updated.
Description
Using the $__timeGroup macro, one can achieve an OOM by overloading the server. This requires a SQL datasource. If the server is set up to auto-restart, the impact is minimal or non-existent, as the attack can take upwards of half an hour to crash the server.
CVSS metrics
5 scores · 5 sources · 1 versionMedium 6.5Preferred score · CVE.org (CNA)
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:HSourcesAll 5 agree
- OSV · UbuntuEcosystem advisory · calculated6.5MediumCVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H
- OSV · WolfiEcosystem advisory · calculated6.5MediumCVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H
- OSV · ChainguardEcosystem advisory · calculated6.5MediumCVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H
- NVDNIST6.5MediumCVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H
EPSS trend
Probability
0.33%
Chance of exploitation in the next 30 days
Percentile
25%
Versus all other CVEs
30-day change
0.00 pp
From 0.33% on 21-09-2026
21-09-202621-10-2026
EPSS score0.33%
Known exploited
Compare KEV catalogsNot in any of the 3 tracked catalogs.
Public exploits
0 foundNo public exploits indexed.
Weaknesses
CWE · root causeAffected systems
Chainguard6 products
- grafana-12.0All versions (No fix recorded)
- grafana-12.1All versions (No fix recorded)
- grafana-12.4< 12.4.3.02-r0
- grafana-fips-12.0All versions (No fix recorded)
- grafana-fips-12.1All versions (No fix recorded)
Grafana2 products
- grafanaEOL≥ 8.0.0, < 11.6.14 | ≥ 12.0.0, < 12.2.8 | ≥ 12.3.0, < 12.3.6 | ≥ 12.4.0, < 12.4.3 | 11.6.14 | 11.6.14:security01 | 12.2.8 | 12.2.8:security01 | 12.3.6 | 12.3.6:security01 | 12.4.3 | 13.0.0 | 13.0.1
- grafana oss≥ 8.0.0, ≤ 11.6.14 | ≥ 11.6.14, < 11.6.14+security-04 | ≥ 12.0.0, ≤ 12.2.8 | ≥ 12.2.8, < 12.2.8+security-04 | ≥ 12.3.0, ≤ 12.3.6 | ≥ 12.3.6, < 12.3.6+security-04 | ≥ 12.4.0, ≤ 12.4.3 | ≥ 12.4.3, < 12.4.3+security-02 | ≥ 13.0.0, ≤ 13.0.1 | ≥ 13.0.1, < 13.0.1+security-01
Ubuntu1 product
- grafanaAll versions (No fix recorded)
Wolfi1 product
- grafana-12.4< 12.4.3.02-r0
4 vendors · 10 products
