Description
A user with the Viewer role can make Grafana allocate an unbounded amount of memory, and crash it, with a single SQL Expression query that casts a value to a very large BINARY length (memory allocation with excessive size value).
Published: 2026-11-11
Score: 6.5 Medium
EPSS: n/a
KEV: No
AI Analysis

Analysis and contextual insights are available on OpenCVE Cloud.

Remediation

No vendor fix or workaround currently provided.

Additional remediation guidance may be available on OpenCVE Cloud.

Tracking

Sign in to view the affected projects.

Advisories

No advisories yet.

History

Wed, 11 Nov 2026 15:15:00 +0000

Type Values Removed Values Added
Description A user with the Viewer role can make Grafana allocate an unbounded amount of memory, and crash it, with a single SQL Expression query that casts a value to a very large BINARY length (memory allocation with excessive size value).
Title Memory exhaustion denial of service in SQL Expressions
Weaknesses CWE-1284
CWE-400
CWE-789
References
Metrics cvssV3_1

{'score': 6.5, 'vector': 'CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H'}

Subscriptions

No data.

cve-icon MITRE

Status: PUBLISHED

Assigner: GRAFANA

Published:

Updated: 2026-11-11T15:02:06.763Z

Reserved: 2026-10-08T09:32:51.742Z

Link: CVE-2026-107509

cve-icon Vulnrichment

No data.

cve-icon NVD

No data.

cve-icon Redhat

No data.

cve-icon OpenCVE Enrichment

No data.

Weaknesses
  • CWE-1284

    Improper Validation of Specified Quantity in Input

  • CWE-400

    Uncontrolled Resource Consumption

  • CWE-789

    Memory Allocation with Excessive Size Value