CVE-2026-28383
Full vulnerability record from the local CVENow database.
Description
A request to the Grafana plugin resources endpoint can cause unbounded memory allocation by reading the entire request body into memory. An authenticated user can exploit this to trigger an out-of-memory condition, potentially causing a denial of service.
Severity
MEDIUM
CVSS score
6.5
(v3.1)
Vulnerability status
Analyzed
Source identifier
Published
2026-05-13 20:16:20.130000
Last modified
2026-10-26 14:10:00.130000
View original CVE JSON
{
"id": "CVE-2026-28383",
"sourceIdentifier": "[email protected]",
"published": "2026-05-13T20:16:20.130",
"lastModified": "2026-10-26T14:10:00.130",
"vulnStatus": "Analyzed",
"cveTags": [],
"descriptions": [
{
"lang": "en",
"value": "A request to the Grafana plugin resources endpoint can cause unbounded memory allocation by reading the entire request body into memory. An authenticated user can exploit this to trigger an out-of-memory condition, potentially causing a denial of service."
},
{
"lang": "es",
"value": "Una solicitud al endpoint de recursos del plugin de Grafana puede causar una asignación de memoria ilimitada al leer el cuerpo completo de la solicitud en la memoria. Un usuario autenticado puede explotar esto para desencadenar una condición de falta de memoria, lo que podría causar una denegación de servicio."
}
],
"affected": [
{
"source": "[email protected]",
"affectedData": [
{
"vendor": "Grafana",
"product": "Grafana OSS",
"defaultStatus": "unaffected",
"versions": [
{
"version": "6.7.0",
"lessThanOrEqual": "11.6.14",
"versionType": "semver",
"status": "affected"
},
{
"version": "11.6.14",
"lessThan": "11.6.14+security-04",
"versionType": "custom",
"status": "affected"
},
{
"version": "12.0.0",
"lessThanOrEqual": "12.2.8",
"versionType": "semver",
"status": "affected"
},
{
"version": "12.2.8",
"lessThan": "12.2.8+security-04",
"versionType": "custom",
"status": "affected"
},
{
"version": "12.3.0",
"lessThanOrEqual": "12.3.6",
"versionType": "semver",
"status": "affected"
},
{
"version": "12.3.6",
"lessThan": "12.3.6+security-04",
"versionType": "custom",
"status": "affected"
},
{
"version": "12.4.0",
"lessThanOrEqual": "12.4.3",
"versionType": "semver",
"status": "affected"
},
{
"version": "12.4.3",
"lessThan": "12.4.3+security-02",
"versionType": "custom",
"status": "affected"
},
{
"version": "13.0.0",
"lessThanOrEqual": "13.0.1",
"versionType": "semver",
"status": "affected"
},
{
"version": "13.0.1",
"lessThan": "13.0.1+security-01",
"versionType": "custom",
"status": "affected"
}
]
}
]
}
],
"metrics": {
"cvssMetricV31": [
{
"source": "[email protected]",
"type": "Secondary",
"cvssData": {
"version": "3.1",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H",
"baseScore": 6.5,
"baseSeverity": "MEDIUM",
"attackVector": "NETWORK",
"attackComplexity": "LOW",
"privilegesRequired": "LOW",
"userInteraction": "NONE",
"scope": "UNCHANGED",
"confidentialityImpact": "NONE",
"integrityImpact": "NONE",
"availabilityImpact": "HIGH"
},
"exploitabilityScore": 2.8,
"impactScore": 3.6
}
],
"ssvcV203": [
{
"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"ssvcData": {
"timestamp": "2026-05-14T12:35:48.301448Z",
"id": "CVE-2026-28383",
"options": [
{
"exploitation": "none"
},
{
"automatable": "no"
},
{
"technicalImpact": "partial"
}
],
"role": "CISA Coordinator",
"version": "2.0.3"
}
}
]
},
"weaknesses": [
{
"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"type": "Secondary",
"description": [
{
"lang": "en",
"value": "CWE-770"
}
]
}
],
"configurations": [
{
"nodes": [
{
"operator": "OR",
"negate": false,
"cpeMatch": [
{
"vulnerable": true,
"criteria": "cpe:2.3:a:grafana:grafana:*:*:*:*:*:*:*:*",
"versionStartIncluding": "8.5.0",
"versionEndExcluding": "11.6.14",
"matchCriteriaId": "3EB52192-B43E-44FD-A838-245DD579DF4E"
},
{
"vulnerable": true,
"criteria": "cpe:2.3:a:grafana:grafana:*:*:*:*:*:*:*:*",
"versionStartIncluding": "12.2.0",
"versionEndExcluding": "12.2.8",
"matchCriteriaId": "37747AB2-8B5F-4BD3-860E-0C092A9F78F0"
},
{
"vulnerable": true,
"criteria": "cpe:2.3:a:grafana:grafana:*:*:*:*:*:*:*:*",
"versionStartIncluding": "12.3.0",
"versionEndExcluding": "12.3.6",
"matchCriteriaId": "870FE01F-86F1-4734-9CC3-6FC9AF3012C5"
},
{
"vulnerable": true,
"criteria": "cpe:2.3:a:grafana:grafana:*:*:*:*:*:*:*:*",
"versionStartIncluding": "12.4.0",
"versionEndExcluding": "12.4.3",
"matchCriteriaId": "4451FBC6-6277-4DD8-B143-0DAE82175D9A"
},
{
"vulnerable": true,
"criteria": "cpe:2.3:a:grafana:grafana:11.6.14:-:*:*:*:*:*:*",
"matchCriteriaId": "548C63DC-4E7F-4D9E-B2F0-AB24A66E0F7F"
},
{
"vulnerable": true,
"criteria": "cpe:2.3:a:grafana:grafana:11.6.14:security01:*:*:*:*:*:*",
"matchCriteriaId": "5F103470-1371-498E-9442-11EA7C2E3A6B"
},
{
"vulnerable": true,
"criteria": "cpe:2.3:a:grafana:grafana:12.2.8:-:*:*:*:*:*:*",
"matchCriteriaId": "4ACC0DB6-8BC4-4975-AD26-D41F69571EF6"
},
{
"vulnerable": true,
"criteria": "cpe:2.3:a:grafana:grafana:12.2.8:security01:*:*:*:*:*:*",
"matchCriteriaId": "9EBE773D-17BB-4402-B0B8-74D3DD79B32C"
},
{
"vulnerable": true,
"criteria": "cpe:2.3:a:grafana:grafana:12.3.6:-:*:*:*:*:*:*",
"matchCriteriaId": "6A58801D-1713-4A52-8713-9DD31F75698D"
},
{
"vulnerable": true,
"criteria": "cpe:2.3:a:grafana:grafana:12.3.6:security01:*:*:*:*:*:*",
"matchCriteriaId": "5C930B25-FD06-477C-B226-DEB486A46DAA"
},
{
"vulnerable": true,
"criteria": "cpe:2.3:a:grafana:grafana:12.4.3:-:*:*:*:*:*:*",
"matchCriteriaId": "172F03B1-E693-4EF3-90A0-D40773E4ACB4"
},
{
"vulnerable": true,
"criteria": "cpe:2.3:a:grafana:grafana:13.0.0:*:*:*:*:*:*:*",
"matchCriteriaId": "0F0B8E4F-ADE7-4594-9241-966B1F0BC440"
},
{
"vulnerable": true,
"criteria": "cpe:2.3:a:grafana:grafana:13.0.1:-:*:*:*:*:*:*",
"matchCriteriaId": "2AD87DC5-DF20-4993-A11B-91EBB313A40A"
}
]
}
]
}
],
"references": [
{
"url": "https://grafana.com/security/security-advisories/cve-2026-28383",
"source": "[email protected]",
"tags": [
"Vendor Advisory"
]
}
]
}