UBUNTU-CVE-2026-21720

Advisory lineage Upstream: 1 Downstream: 0
Upstream
CVE-2026-21720
Published: 27 Jan 2026, 09:15
Last modified:30 Jan 2026, 21:15

Vulnerability Summary

Overall Risk (default)
medium
30/100
CVSS Score
7.5 HIGH
3.1 (osv_ubuntu)
EPSS Score
No data
KEV
Not listed
Ransomware
No reports
Public exploits
None found
Dark Web
Not detected

Timeline

27 Jan 2026, 09:15
Published
Vulnerability first disclosed
30 Jan 2026, 21:15
Last Modified
Vulnerability information updated

Description

Every uncached /avatar/:hash request spawns a goroutine that refreshes the Gravatar image. If the refresh sits in the 10-slot worker queue longer than three seconds, the handler times out and stops listening for the result, so that goroutine blocks forever trying to send on an unbuffered channel. Sustained traffic with random hashes keeps tripping this timeout, so goroutine count grows linearly, eventually exhausting memory and causing Grafana to crash on some systems.

CVSS Metrics

  • v3.1•HIGH•Score: 7.5CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

Affected Systems

  • ubuntu•grafana

    all

References (3)