CVE-2026-33382

{
  "id": "CVE-2026-33382",
  "sourceIdentifier": "[email protected]",
  "published": "2026-07-10T16:16:29.130",
  "lastModified": "2026-10-25T15:10:00.147",
  "vulnStatus": "Analyzed",
  "cveTags": [],
  "descriptions": [
    {
      "lang": "en",
      "value": "Several Grafana API endpoints, some of them unauthenticated, do not limit the size of the request body before processing it. An attacker can send very large payloads that force excessive memory allocation, potentially exhausting memory and causing a denial of service."
    },
    {
      "lang": "es",
      "value": "Varios puntos finales de la API de Grafana, algunos de ellos no autenticados, no limitan el tamaño del cuerpo de la solicitud antes de procesarlo. Un atacante puede enviar cargas útiles muy grandes que fuerzan una asignación excesiva de memoria, agotando potencialmente la memoria y causando una denegación de servicio."
    }
  ],
  "affected": [
    {
      "source": "[email protected]",
      "affectedData": [
        {
          "vendor": "Grafana",
          "product": "Grafana OSS",
          "defaultStatus": "unaffected",
          "versions": [
            {
              "version": "11.6.0",
              "lessThanOrEqual": "11.6.14",
              "versionType": "semver",
              "status": "affected"
            },
            {
              "version": "12.2.0",
              "lessThanOrEqual": "12.2.8",
              "versionType": "semver",
              "status": "affected"
            },
            {
              "version": "12.3.0",
              "lessThanOrEqual": "12.3.6",
              "versionType": "semver",
              "status": "affected"
            },
            {
              "version": "12.4.0",
              "lessThanOrEqual": "12.4.3",
              "versionType": "semver",
              "status": "affected"
            },
            {
              "version": "13.0.0",
              "lessThanOrEqual": "13.0.1",
              "versionType": "semver",
              "status": "affected"
            }
          ]
        }
      ]
    }
  ],
  "metrics": {
    "cvssMetricV31": [
      {
        "source": "[email protected]",
        "type": "Secondary",
        "cvssData": {
          "version": "3.1",
          "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
          "baseScore": 7.5,
          "baseSeverity": "HIGH",
          "attackVector": "NETWORK",
          "attackComplexity": "LOW",
          "privilegesRequired": "NONE",
          "userInteraction": "NONE",
          "scope": "UNCHANGED",
          "confidentialityImpact": "NONE",
          "integrityImpact": "NONE",
          "availabilityImpact": "HIGH"
        },
        "exploitabilityScore": 3.9,
        "impactScore": 3.6
      }
    ],
    "ssvcV203": [
      {
        "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
        "ssvcData": {
          "timestamp": "2026-07-10T15:59:38.846803Z",
          "id": "CVE-2026-33382",
          "options": [
            {
              "exploitation": "none"
            },
            {
              "automatable": "yes"
            },
            {
              "technicalImpact": "partial"
            }
          ],
          "role": "CISA Coordinator",
          "version": "2.0.3"
        }
      }
    ]
  },
  "weaknesses": [
    {
      "source": "[email protected]",
      "type": "Secondary",
      "description": [
        {
          "lang": "en",
          "value": "CWE-400"
        }
      ]
    }
  ],
  "configurations": [
    {
      "nodes": [
        {
          "operator": "OR",
          "negate": false,
          "cpeMatch": [
            {
              "vulnerable": true,
              "criteria": "cpe:2.3:a:grafana:grafana:*:*:*:*:-:*:*:*",
              "versionStartIncluding": "11.6.0",
              "versionEndExcluding": "11.6.15",
              "matchCriteriaId": "B154BC07-0914-4E25-9D84-FB64205493F7"
            },
            {
              "vulnerable": true,
              "criteria": "cpe:2.3:a:grafana:grafana:*:*:*:*:-:*:*:*",
              "versionStartIncluding": "12.2.0",
              "versionEndExcluding": "12.2.9",
              "matchCriteriaId": "052CFAA8-0386-43DF-869A-643997178E8D"
            },
            {
              "vulnerable": true,
              "criteria": "cpe:2.3:a:grafana:grafana:*:*:*:*:-:*:*:*",
              "versionStartIncluding": "12.3.0",
              "versionEndExcluding": "12.3.7",
              "matchCriteriaId": "C77AA4CC-A590-4948-A010-5A1154502E47"
            },
            {
              "vulnerable": true,
              "criteria": "cpe:2.3:a:grafana:grafana:*:*:*:*:-:*:*:*",
              "versionStartIncluding": "12.4.0",
              "versionEndExcluding": "12.4.4",
              "matchCriteriaId": "F820291A-C1C6-4DBC-8064-6133F16547C4"
            },
            {
              "vulnerable": true,
              "criteria": "cpe:2.3:a:grafana:grafana:*:*:*:*:-:*:*:*",
              "versionStartIncluding": "13.0.0",
              "versionEndExcluding": "13.0.2",
              "matchCriteriaId": "643002A3-545F-4605-AAAF-EF55C5B14392"
            }
          ]
        }
      ]
    }
  ],
  "references": [
    {
      "url": "https://grafana.com/security/security-advisories/cve-2026-33382",
      "source": "[email protected]",
      "tags": [
        "Vendor Advisory"
      ]
    }
  ]
}