VDB
Sign up
HIGH7.5

GHSA-3w66-95m3-8jxg

Grafana: Pre-authentication denial of service in the public dashboard query handler

Quick fix

GHSA-3w66-95m3-8jxg — github.com/grafana/grafana: upgrade to the fixed version with the command below.

go get github.com/grafana/grafana@v1.9.2-0.20260616075434-82ef13993059

Details

The public dashboard query endpoint does not limit request body size before processing, allowing unauthenticated attackers to trigger excessive memory allocation by sending arbitrarily large JSON payloads. This can lead to denial of service through memory exhaustion. No valid dashboard access token or authentication is required to exploit this vulnerability.

Are you affected?

Enter the version of the package you're using.

Affected packages

Go/github.com/grafana/grafana
Introduced in: 2.0.0-beta1

No fixed version published yet for github.com/grafana/grafana (go modules). Pin to a known-safe version or switch to an alternative.

Go/github.com/grafana/grafana
Introduced in: 12.0.0

No fixed version published yet for github.com/grafana/grafana (go modules). Pin to a known-safe version or switch to an alternative.

Go/github.com/grafana/grafana
Introduced in: 12.3.0

No fixed version published yet for github.com/grafana/grafana (go modules). Pin to a known-safe version or switch to an alternative.

Go/github.com/grafana/grafana
Introduced in: 12.4.0

No fixed version published yet for github.com/grafana/grafana (go modules). Pin to a known-safe version or switch to an alternative.

Go/github.com/grafana/grafana
Introduced in: 13.0.0

No fixed version published yet for github.com/grafana/grafana (go modules). Pin to a known-safe version or switch to an alternative.

Go/github.com/grafana/grafana
Introduced in: 0Fixed in: 1.9.2-0.20260616075434-82ef13993059
Fixgo get github.com/grafana/grafana@v1.9.2-0.20260616075434-82ef13993059

References