HIGH7.5
GHSA-p4r4-xvrq-gvmc
Grafana Tempo has an Uncontrolled Resource Consumption issue
Quick fix
GHSA-p4r4-xvrq-gvmc — github.com/grafana/tempo: upgrade to the fixed version with the command below.
go get github.com/grafana/tempo@v2.8.4Details
Tempo queries with large limits can cause large memory allocations which can impact the availability of the service, depending on its deployment strategy.
Mitigation can be done by setting max_result_limit in the search config, e.g. to 262144 (2^18).
Are you affected?
Enter the version of the package you're using.
Affected packages
Go/github.com/grafana/tempo
Introduced in:
1.3.0Fixed in: 2.8.4Fix
go get github.com/grafana/tempo@v2.8.4Go/github.com/grafana/tempo
Introduced in:
2.9.0Fixed in: 2.9.2Fix
go get github.com/grafana/tempo@v2.9.2Go/github.com/grafana/tempo
Introduced in:
2.10.0Fixed in: 2.10.2Fix
go get github.com/grafana/tempo@v2.10.2References
- https://nvd.nist.gov/vuln/detail/CVE-2026-21728[ADVISORY]
- https://github.com/grafana/tempo/pull/6525[WEB]
- https://github.com/grafana/tempo/commit/650eb1985a0776789c8564122990f588a742356f[WEB]
- https://github.com/grafana/tempo[PACKAGE]
- https://github.com/grafana/tempo/blob/4dc3e5b0d3463a0b67498b662b85a148698b4afd/docs/sources/tempo/release-notes/version-2/v2-10.md?plain=1#L328[WEB]
- https://github.com/grafana/tempo/blob/4dc3e5b0d3463a0b67498b662b85a148698b4afd/docs/sources/tempo/release-notes/version-2/v2-8.md?plain=1#L251[WEB]
- https://github.com/grafana/tempo/blob/4dc3e5b0d3463a0b67498b662b85a148698b4afd/docs/sources/tempo/release-notes/version-2/v2-9.md?plain=1#L224[WEB]
- https://grafana.com/security/security-advisories/cve-2026-21728[WEB]