{"id":"CVE-2026-27880","aliases":["ALPINE-CVE-2026-27880","BIT-grafana-2026-27880","EUVD-2026-16598","GHSA-jmfj-8gxc-cg8c","UBUNTU-CVE-2026-27880"],"status":"published","title":"OpenFeature evaluation API reads input data with no bounds","description":"The OpenFeature feature toggle evaluation endpoint reads unbounded values into memory, which can cause out-of-memory crashes.","severity":{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"high","assessor":"cna","from":"cve"},"epss":{"day":"2026-11-12","score":0.00786,"percentile":0.56598,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":false,"fix_available":true},"cwes":["CWE-125","CWE-770","CWE-787"],"published":"2026-03-27T14:12:20Z","modified":"2026-11-03T06:32:53Z","fixes":[{"ecosystem":"Alpine:v3.23","package":"grafana","fixed_in":["12.2.8-r0"],"sources":["osv"]},{"ecosystem":"Alpine:v3.24","package":"grafana","fixed_in":["12.4.3-r0"],"sources":["osv"]},{"ecosystem":"Bitnami","package":"grafana","fixed_in":["12.1.10","12.2.8","12.3.6","12.4.2"],"sources":["osv"]}],"affected":[{"source":"osv","ecosystem":"Alpine:v3.23","package":"grafana","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"12.1.10"},{"fixed":"12.2.8-r0"}]}]},{"source":"osv","ecosystem":"Alpine:v3.24","package":"grafana","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"12.1.10"},{"fixed":"12.4.3-r0"}]}]},{"source":"osv","ecosystem":"Bitnami","package":"grafana","ranges":[{"type":"SEMVER","events":[{"introduced":"12.1.0"},{"fixed":"12.1.10"},{"introduced":"12.2.0"},{"fixed":"12.2.8"},{"introduced":"12.3.0"},{"fixed":"12.3.6"},{"introduced":"12.4.0"},{"fixed":"12.4.2"}]}]},{"source":"osv","ecosystem":"Ubuntu:16.04:LTS","package":"grafana","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["2.6.0+dfsg-1"]}],"products":[{"vendor":"grafana","product":"grafana"},{"vendor":"red hat","product":"red hat enterprise linux 10"},{"vendor":"red hat","product":"red hat enterprise linux 8"},{"vendor":"red hat","product":"red hat enterprise linux 9"}],"references":[{"url":"https://grafana.com/security/security-advisories/cve-2026-27880","tags":["vendor-advisory","broken-link","Vendor Advisory","advisory","report"]},{"url":"https://access.redhat.com/security/cve/CVE-2026-27880","tags":["vdb-entry","x_refsource_REDHAT","web","advisory"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2452295","tags":["issue-tracking","x_refsource_REDHAT","web","report"]},{"url":"https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-27880.json","tags":["x_sadp-csaf-vex","web"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-27880","tags":["web","advisory"]},{"url":"https://github.com/advisories/GHSA-jmfj-8gxc-cg8c"},{"url":"https://security.alpinelinux.org/vuln/CVE-2026-27880","tags":["advisory"]},{"url":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/27xxx/CVE-2026-27880.json","tags":["advisory"]},{"url":"https://ubuntu.com/security/CVE-2026-27880","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2026-27880","tags":["report"]}],"sources":{"cve":[{"id":"CVE-2026-27880","title":"OpenFeature evaluation API reads input data with no bounds","description":"The OpenFeature feature toggle evaluation endpoint reads unbounded values into memory, which can cause out-of-memory crashes.","status":"published","published":"2026-03-27T14:12:20.075Z","modified":"2026-08-27T17:22:49.478Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"high","assessor":"cna"},{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"high","assessor":"adp"}],"cwes":["CWE-125","CWE-770"],"updated_at":"2026-11-02T14:19:49.199185Z"}],"euvd":[{"id":"EUVD-2026-16598","description":"The OpenFeature feature toggle evaluation endpoint reads unbounded values into memory, which can cause out-of-memory crashes.","status":"published","published":"2026-03-27T14:12:20Z","modified":"2026-08-27T17:22:49Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"high"}],"updated_at":"2026-11-02T18:01:27.27583Z"}],"ghsa":[{"id":"GHSA-jmfj-8gxc-cg8c","title":"The OpenFeature feature toggle evaluation endpoint reads unbounded values into memory, which can...","description":"The OpenFeature feature toggle evaluation endpoint reads unbounded values into memory, which can cause out-of-memory crashes.","status":"published","published":"2026-03-27T15:30:25Z","modified":"2026-06-30T03:36:03Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"high"}],"cwes":["CWE-125","CWE-770","CWE-787"],"updated_at":"2026-11-02T15:09:04.668745Z"}],"nvd":[{"id":"CVE-2026-27880","description":"The OpenFeature feature toggle evaluation endpoint reads unbounded values into memory, which can cause out-of-memory crashes.","status":"published","published":"2026-03-27T15:16:51.323Z","modified":"2026-07-15T02:19:11.95Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"high","assessor":"secondary"},{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"high","assessor":"secondary"}],"cwes":["CWE-787","CWE-125","CWE-770"],"updated_at":"2026-11-02T14:12:11.678711Z"}],"osv":[{"id":"ALPINE-CVE-2026-27880","description":"The OpenFeature feature toggle evaluation endpoint reads unbounded values into memory, which can cause out-of-memory crashes.","status":"published","published":"2026-03-27T15:16:51.323Z","modified":"2026-11-03T06:32:53.736234534Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"high"}],"updated_at":"2026-11-03T07:16:26.770911Z"},{"id":"CVE-2026-27880","title":"OpenFeature evaluation API reads input data with no bounds","description":"The OpenFeature feature toggle evaluation endpoint reads unbounded values into memory, which can cause out-of-memory crashes.","status":"published","published":"2026-03-27T14:12:20.075Z","modified":"2026-10-28T02:31:13.541195547Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"high"}],"updated_at":"2026-11-02T15:45:00.180685Z"},{"id":"UBUNTU-CVE-2026-27880","description":"The OpenFeature feature toggle evaluation endpoint reads unbounded values into memory, which can cause out-of-memory crashes.","status":"published","published":"2026-03-27T15:16:00Z","modified":"2026-06-30T18:17:45.022962236Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"high"},{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"high"}],"updated_at":"2026-11-02T16:56:08.726452Z"},{"id":"BIT-grafana-2026-27880","title":"OpenFeature evaluation API reads input data with no bounds","description":"The OpenFeature feature toggle evaluation endpoint reads unbounded values into memory, which can cause out-of-memory crashes.","status":"published","published":"2026-04-01T08:41:13.459Z","modified":"2026-09-08T08:47:51.446348007Z","updated_at":"2026-11-02T15:28:31.02759Z"}]}}