Every CVE Search/ Get API key

CVE-2025-1088

Very long unicode dashboard title or panel name can hang the frontend

2.7 LowFix available

In Grafana, an excessively long dashboard title or panel name will cause Chromium browsers to become unresponsive due to Improper Input Validation vulnerability in Grafana. This issue affects Grafana: before 11.6.2 and is fixed in 11.6.2 and higher.

Attack profile

How easy it is to exploit

Attack vector
Network
Complexity
Low
Privileges needed
High
User interaction
None

What an attacker can affect

Confidentiality
None
Integrity
None
Availability
Low

Exploit likelihood

0.47%Up 0.4 points since Jun 18, 2025
90%50%10%1%

What each source reports

CVE List Score used 2.7

Very long unicode dashboard title or panel name can hang the frontend

In Grafana, an excessively long dashboard title or panel name will cause Chromium browsers to become unresponsive due to Improper Input Validation vulnerability in Grafana. This issue affects Grafana: before 11.6.2 and is fixed in 11.6.2 and higher.

Record
CVE-2025-1088
CVSS 3.1
2.7 LowCVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:N/A:L
Weakness
CWE-20
Updated
2026-11-02
EUVDEUVD-2025-18570 2.7

In Grafana, an excessively long dashboard title or panel name will cause Chromium browsers to become unresponsive due to Improper Input Validation vulnerability in Grafana. This issue affects Grafana: before 11.6.2 and is fixed in 11.6.2 and higher.

Record
EUVD-2025-18570
CVSS 3.1
2.7 LowCVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:N/A:L
Updated
2026-11-02
GitHub AdvisoriesGHSA-crvv-6w6h-cv34 2.7

Grafana long dashboard title or panel name causes unresponsives

In Grafana, an excessively long dashboard title or panel name will cause Chromium browsers to become unresponsive due to Improper Input Validation vulnerability in Grafana. This issue affects Grafana: before 11.6.2 and is fixed in 11.6.2 and higher.

Record
GHSA-crvv-6w6h-cv34
CVSS 3.1
2.7 LowCVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:N/A:L
Weakness
CWE-20
Updated
2026-11-02
NVD 2.7

In Grafana, an excessively long dashboard title or panel name will cause Chromium browsers to become unresponsive due to Improper Input Validation vulnerability in Grafana. This issue affects Grafana: before 11.6.2 and is fixed in 11.6.2 and higher.

Record
CVE-2025-1088
CVSS 3.1
2.7 LowCVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:N/A:L
Weakness
CWE-20
Updated
2026-11-02
OSVGHSA-crvv-6w6h-cv34 2.7

Grafana long dashboard title or panel name causes unresponsives

In Grafana, an excessively long dashboard title or panel name will cause Chromium browsers to become unresponsive due to Improper Input Validation vulnerability in Grafana. This issue affects Grafana: before 11.6.2 and is fixed in 11.6.2 and higher.

Record
GHSA-crvv-6w6h-cv34
CVSS 3.1
2.7 LowCVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:N/A:L
Weakness
CWE-20
Updated
2026-11-02
OSVUBUNTU-CVE-2025-1088 2.7

In Grafana, an excessively long dashboard title or panel name will cause Chromium browsers to become unresponsive due to Improper Input Validation vulnerability in Grafana. This issue affects Grafana: before 11.6.2 and is fixed in 11.6.2 and higher.

Record
UBUNTU-CVE-2025-1088
CVSS 3.1
2.7 LowCVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:N/A:L
Updated
2026-11-02
Show 4 moreShow less
OSVBIT-grafana-2025-1088 No score

Very long unicode dashboard title or panel name can hang the frontend

In Grafana, an excessively long dashboard title or panel name will cause Chromium browsers to become unresponsive due to Improper Input Validation vulnerability in Grafana. This issue affects Grafana: before 11.6.2 and is fixed in 11.6.2 and higher.

Record
BIT-grafana-2025-1088
Updated
2026-11-02
OSVGO-2025-3766 No score

Grafana long dashboard title or panel name causes unresponsives in github.com/grafana/grafana

Grafana long dashboard title or panel name causes unresponsives in github.com/grafana/grafana.

NOTE: The source advisory for this report contains additional versions that could not be automatically mapped to standard Go module versions.

(If this is causing false-positive reports from vulnerability scanners, please suggest an edit to the report.)

The additional affected modules and versions are: github.com/grafana/grafana before v11.6.2.

Record
GO-2025-3766
Updated
2026-11-02
OSVopenSUSE-SU-2025:15226-1 No score

grafana-11.6.3-1.1 on GA media

These are all security issues fixed in the grafana-11.6.3-1.1 package on the GA media of openSUSE Tumbleweed.

Record
openSUSE-SU-2025:15226-1
Updated
2026-11-02
OSVopenSUSE-SU-2025:15405-1 No score

govulncheck-vulndb-0.0.20250730T213748-1.1 on GA media

These are all security issues fixed in the govulncheck-vulndb-0.0.20250730T213748-1.1 package on the GA media of openSUSE Tumbleweed.

Record
openSUSE-SU-2025:15405-1
Updated
2026-11-02

Affected products

Affected packages

Affected packages
PackageAffectedFixed
github.com/grafana/grafana
Go
 0.0.1-test up to 11.6.2
11.6.2
github.com/grafana/grafana
Go
 before 0.0.0-20250521211231-e0ba4b480954
0.0.0-20250521211231-e0ba4b480954
grafana
Bitnami
 before 11.6.2
11.6.2
github.com/grafana/grafana
Go
 before 0.0.0-20250521211231-e0ba4b480954, 0.0.1-test and later
0.0.0-20250521211231-e0ba4b480954
grafana
Ubuntu:16.04:LTS
 All versions, plus listed versions
2.6.0+dfsg-1
 None known
grafana
openSUSE:Tumbleweed
From an advisory covering 2 CVEs
 before 11.6.3-1.1
11.6.3-1.1
govulncheck-vulndb
openSUSE:Tumbleweed
From an advisory covering 56 CVEs
 before 0.0.20250730T213748-1.1
0.0.20250730T213748-1.1

History

History
RecordedChangedSources
affected, facts
first indexedCVE List, EUVD, GitHub Advisories, NVD, OSV

Dates are when Every CVE recorded each change. Upstream dates may differ.

In short

CVE-2025-1088 is a low vulnerability (CVSS 2.7) in Grafana, published June 18, 2025. No source lists public exploit code. EPSS puts the chance of exploitation in the next 30 days at 0.47%, the 40th percentile. Fixed in github.com/grafana/grafana 11.6.2.

References

Show 56 moreShow less
Pages All vulnerabilities Browse Docs Sources Guide Get API key
MoveEnter Open