{"id":"CVE-2026-33382","aliases":["ALPINE-CVE-2026-33382","ALSA-2026:54178","BIT-grafana-2026-33382","CLSA-2026-1792757203","EUVD-2026-42920","GHSA-xcrv-g5fh-9wx2","RHSA-2026:54178","RHSA-2026:63164","RHSA-2026:63165","RHSA-2026:65157","RHSA-2026:67517","RLSA-2026:54178","SUSE-SU-2026:3713-1","SUSE-SU-2026:3714-1","SUSE-SU-2026:3718-1","openSUSE-SU-2026:11277-1","openSUSE-SU-2026:21366-1"],"status":"published","title":"Denial of service via unbounded request body size","description":"Several Grafana API endpoints, some of them unauthenticated, do not limit the size of the request body before processing it. An attacker can send very large payloads that force excessive memory allocation, potentially exhausting memory and causing a denial of service.","severity":{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"high","assessor":"cna","from":"cve"},"epss":{"day":"2026-11-11","score":0.00388,"percentile":0.33339,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":false,"fix_available":true},"cwes":["CWE-400"],"published":"2026-07-10T14:58:23Z","modified":"2026-11-10T17:23:21Z","fixes":[{"ecosystem":"Alpine:v3.24","package":"grafana","fixed_in":["12.4.4-r0"],"sources":["osv"]},{"ecosystem":"Bitnami","package":"grafana","fixed_in":["11.6.15","12.2.9","12.3.7","12.4.4","13.0.2"],"sources":["osv"]},{"ecosystem":"TuxCare:AlmaLinux:9.2","package":"grafana","fixed_in":["9.0.9-4.el9_2.alma.1.tuxcare.els25"],"sources":["osv"]},{"ecosystem":"openSUSE:Tumbleweed","package":"grafana","fixed_in":["12.4.5-1.1"],"sources":["osv"]}],"affected":[{"source":"osv","ecosystem":"Alpine:v3.24","package":"grafana","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"11.6.0"},{"fixed":"12.4.4-r0"}]}]},{"source":"osv","ecosystem":"AlmaLinux:10","package":"grafana","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"10.2.6-28.el10_2.4"}]}],"bundled":5},{"source":"osv","ecosystem":"AlmaLinux:10","package":"grafana-selinux","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"10.2.6-28.el10_2.4"}]}],"bundled":5},{"source":"osv","ecosystem":"Bitnami","package":"grafana","ranges":[{"type":"SEMVER","events":[{"introduced":"11.6.0"},{"fixed":"11.6.15"},{"introduced":"12.2.0"},{"fixed":"12.2.9"},{"introduced":"12.3.0"},{"fixed":"12.3.7"},{"introduced":"12.4.0"},{"fixed":"12.4.4"},{"introduced":"13.0.0"},{"fixed":"13.0.2"}]}]},{"source":"osv","ecosystem":"TuxCare:AlmaLinux:9.2","package":"grafana","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"9.0.9-4.el9_2.alma.1.tuxcare.els25"}]}]},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:10.2","package":"grafana","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:10.2.6-28.el10_2.4"}]}],"bundled":5},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:10.2","package":"grafana-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:10.2.6-28.el10_2.4"}]}],"bundled":5},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:10.2","package":"grafana-debugsource","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:10.2.6-28.el10_2.4"}]}],"bundled":5},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:10.2","package":"grafana-selinux","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:10.2.6-28.el10_2.4"}]}],"bundled":5},{"source":"osv","ecosystem":"Red Hat:hummingbird:1","package":"grafana13.2","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:13.2.1-0.1.hum1"}]}],"bundled":10},{"source":"osv","ecosystem":"Red Hat:hummingbird:1","package":"grafana13.1","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:13.1.3-0.5.hum1"}]}],"bundled":8},{"source":"osv","ecosystem":"Red Hat:hummingbird:1","package":"grafana12.4","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:12.4.10-0.1.hum1"}]}],"bundled":7},{"source":"osv","ecosystem":"Red Hat:enterprise_linux_eus:10.0","package":"grafana","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:10.2.6-26.el10_0"}]}],"bundled":20},{"source":"osv","ecosystem":"Red Hat:enterprise_linux_eus:10.0","package":"grafana-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:10.2.6-26.el10_0"}]}],"bundled":20},{"source":"osv","ecosystem":"Red Hat:enterprise_linux_eus:10.0","package":"grafana-debugsource","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:10.2.6-26.el10_0"}]}],"bundled":20},{"source":"osv","ecosystem":"Red Hat:enterprise_linux_eus:10.0","package":"grafana-selinux","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:10.2.6-26.el10_0"}]}],"bundled":20},{"source":"osv","ecosystem":"Rocky Linux:10","package":"grafana","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:10.2.6-28.el10_2.4"}]}],"bundled":4},{"source":"osv","ecosystem":"SUSE:Multi Linux Manager Tools SLE-15","package":"golang-github-prometheus-alertmanager","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.28.1-150002.4.14.1"}]}],"bundled":8},{"source":"osv","ecosystem":"SUSE:Multi Linux Manager Tools SLE-15","package":"golang-github-prometheus-prometheus","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.5.4-150002.3.16.1"}]}],"bundled":8},{"source":"osv","ecosystem":"SUSE:Multi Linux Manager Tools SLE-15","package":"grafana","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"12.4.5-150002.4.24.1"}]}],"bundled":8},{"source":"osv","ecosystem":"SUSE:Manager Client Tools 15","package":"golang-github-prometheus-alertmanager","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.28.1-150100.4.34.1"}]}],"bundled":9},{"source":"osv","ecosystem":"SUSE:Manager Client Tools 15","package":"golang-github-prometheus-prometheus","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.5.4-150000.3.75.1"}]}],"bundled":9},{"source":"osv","ecosystem":"SUSE:Manager Client Tools 15","package":"grafana","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"12.4.5-150000.1.98.1"}]}],"bundled":9},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Module for Package Hub 15 SP7","package":"golang-github-prometheus-alertmanager","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.28.1-150100.4.34.1"}]}],"bundled":9},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Module for Package Hub 15 SP7","package":"golang-github-prometheus-prometheus","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.5.4-150100.4.37.2"}]}],"bundled":9},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Module for Package Hub 15 SP7","package":"grafana","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"12.4.5-150200.3.91.1"}]}],"bundled":22},{"source":"osv","ecosystem":"openSUSE:Tumbleweed","package":"grafana","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"12.4.5-1.1"}]}]},{"source":"osv","ecosystem":"openSUSE:Leap 16.0","package":"grafana","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"12.4.5-bp160.2.1"}]}],"bundled":2}],"products":[{"vendor":"grafana","product":"grafana"},{"vendor":"grafana","product":"grafana oss"}],"references":[{"url":"https://grafana.com/security/security-advisories/cve-2026-33382","tags":["vendor-advisory","Vendor Advisory","advisory","article"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-33382","tags":["web","advisory"]},{"url":"https://github.com/advisories/GHSA-xcrv-g5fh-9wx2"},{"url":"https://security.alpinelinux.org/vuln/CVE-2026-33382","tags":["advisory"]},{"url":"https://access.redhat.com/errata/RHSA-2026:54178","tags":["advisory"]},{"url":"https://access.redhat.com/security/cve/CVE-2026-33376","tags":["report"]},{"url":"https://access.redhat.com/security/cve/CVE-2026-33377","tags":["report"]},{"url":"https://access.redhat.com/security/cve/CVE-2026-33382","tags":["report"]},{"url":"https://access.redhat.com/security/cve/CVE-2026-8609","tags":["report"]},{"url":"https://bugzilla.redhat.com/2477246","tags":["report"]},{"url":"https://bugzilla.redhat.com/2477262","tags":["report"]},{"url":"https://bugzilla.redhat.com/2499061","tags":["report"]},{"url":"https://bugzilla.redhat.com/2499062","tags":["report"]},{"url":"https://errata.almalinux.org/10/ALSA-2026-54178.html","tags":["advisory"]},{"url":"https://www.redhat.com/security/data/cve/CVE-2026-42127.html","tags":["report"]},{"url":"https://errata.tuxcare.com/els_os/almalinux9.2esu/CLSA-2026-1792757203.html","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-15815","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-29063","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-59869","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-84375","tags":["advisory"]},{"url":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/33xxx/CVE-2026-33382.json","tags":["advisory"]},{"url":"https://access.redhat.com/security/updates/classification/#moderate","tags":["article"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2477246","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2477262","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2499061","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2499062","tags":["report"]},{"url":"https://issues.redhat.com/browse/RHEL-188282","tags":["article"]},{"url":"https://security.access.redhat.com/data/csaf/v2/advisories/2026/rhsa-2026_54178.json","tags":["advisory"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2026-8609","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-8609","tags":["advisory"]},{"url":"https://grafana.com/security/security-advisories/cve-2026-8609","tags":["article"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2026-33376","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-33376","tags":["advisory"]},{"url":"https://grafana.com/security/security-advisories/cve-2026-33376","tags":["article"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2026-33377","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-33377","tags":["advisory"]},{"url":"https://grafana.com/security/security-advisories/cve-2026-33377","tags":["article"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2026-33382","tags":["advisory"]},{"url":"https://access.redhat.com/security/cve/CVE-2026-42127","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2491449","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2026-42127","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-42127","tags":["advisory"]},{"url":"https://grafana.com/security/security-advisories/cve-2026-42127","tags":["article"]},{"url":"https://access.redhat.com/errata/RHSA-2026:63164","tags":["advisory"]},{"url":"https://images.redhat.com/","tags":["article"]},{"url":"https://access.redhat.com/security/cve/CVE-2026-82562","tags":["report"]},{"url":"https://access.redhat.com/security/updates/classification/","tags":["article"]},{"url":"https://access.redhat.com/security/cve/CVE-2026-82417","tags":["report"]},{"url":"https://access.redhat.com/security/cve/CVE-2026-17033","tags":["report"]},{"url":"https://access.redhat.com/security/cve/CVE-2026-19197","tags":["report"]},{"url":"https://access.redhat.com/security/cve/CVE-2026-21723","tags":["report"]},{"url":"https://access.redhat.com/security/cve/CVE-2026-9765","tags":["report"]},{"url":"https://access.redhat.com/security/cve/CVE-2026-8595","tags":["report"]},{"url":"https://access.redhat.com/security/cve/CVE-2026-84375","tags":["report"]},{"url":"https://security.access.redhat.com/data/csaf/v2/advisories/2026/rhsa-2026_63164.json","tags":["advisory"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2499051","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2026-8595","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-8595","tags":["advisory"]},{"url":"https://grafana.com/security/security-advisories/cve-2026-8595","tags":["article"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2506730","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2026-9765","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-9765","tags":["advisory"]},{"url":"https://grafana.com/security/security-advisories/cve-2026-9765","tags":["article"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2521910","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2026-17033","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-17033","tags":["advisory"]},{"url":"https://grafana.com/security/security-advisories/cve-2026-17033","tags":["article"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2524303","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2026-19197","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-19197","tags":["advisory"]},{"url":"https://grafana.com/security/security-advisories/cve-2026-19197","tags":["article"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2506342","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2026-21723","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-21723","tags":["advisory"]},{"url":"https://grafana.com/security/security-advisories/cve-2026-21723","tags":["article"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2525936","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2026-82417","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-82417","tags":["advisory"]},{"url":"https://github.com/ljharb/qs/commit/e83d321ffafb38cf210683ac31714fce6ce1c6c6","tags":["article"]},{"url":"https://github.com/ljharb/qs/security/advisories/GHSA-4mjr-xmp4-gh2g","tags":["article"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2525939","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2026-82562","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-82562","tags":["advisory"]},{"url":"https://github.com/ljharb/qs/commit/8859c37470e11b42b547b275e4e9bd0bc8cc5464","tags":["article"]},{"url":"https://github.com/ljharb/qs/security/advisories/GHSA-w7fw-mjwx-w883","tags":["article"]},{"url":"https://github.com/ljharb/qs/security/advisories/GHSA-x5fp-wj9c-mxmx","tags":["article"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2527118","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2026-84375","tags":["advisory"]},{"url":"https://github.com/nodeca/js-yaml/commit/3485bc06ff8a0251505f44a00414d90df2466639","tags":["article"]},{"url":"https://github.com/nodeca/js-yaml/commit/6a8e05f9a485188ed730ac81e81ae221352ef480","tags":["article"]},{"url":"https://github.com/nodeca/js-yaml/commit/d90b6612a5a84385bdcb556c44578eac76dc0f6b","tags":["article"]},{"url":"https://github.com/nodeca/js-yaml/pull/797","tags":["article"]},{"url":"https://github.com/nodeca/js-yaml/releases/tag/3.15.2","tags":["article"]},{"url":"https://github.com/nodeca/js-yaml/releases/tag/4.3.2","tags":["article"]},{"url":"https://github.com/nodeca/js-yaml/security/advisories/GHSA-2883-xcg3-v3hh","tags":["article"]},{"url":"https://access.redhat.com/errata/RHSA-2026:63165","tags":["advisory"]},{"url":"https://security.access.redhat.com/data/csaf/v2/advisories/2026/rhsa-2026_63165.json","tags":["advisory"]},{"url":"https://access.redhat.com/errata/RHSA-2026:65157","tags":["advisory"]},{"url":"https://access.redhat.com/security/cve/CVE-2026-17183","tags":["report"]},{"url":"https://security.access.redhat.com/data/csaf/v2/advisories/2026/rhsa-2026_65157.json","tags":["advisory"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2519801","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2026-17183","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-17183","tags":["advisory"]},{"url":"https://grafana.com/security/security-advisories/cve-2026-17183","tags":["article"]},{"url":"https://access.redhat.com/errata/RHSA-2026:67517","tags":["advisory"]},{"url":"https://access.redhat.com/security/updates/classification/#important","tags":["article"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2445345","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2456335","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2467809","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2467820","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2480756","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2480757","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2480761","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2480762","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2515815","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2515820","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2515827","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2515838","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2515839","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2515840","tags":["report"]},{"url":"https://security.access.redhat.com/data/csaf/v2/advisories/2026/rhsa-2026_67517.json","tags":["advisory"]},{"url":"https://access.redhat.com/security/cve/CVE-2026-25681","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2026-25681","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-25681","tags":["advisory"]},{"url":"https://go.dev/cl/781703","tags":["article"]},{"url":"https://go.dev/issue/79574","tags":["article"]},{"url":"https://groups.google.com/g/golang-announce/c/iI-mYSI0lu8","tags":["article"]},{"url":"https://pkg.go.dev/vuln/GO-2026-5029","tags":["advisory"]},{"url":"https://access.redhat.com/security/cve/CVE-2026-27136","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2026-27136","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-27136","tags":["advisory"]},{"url":"https://go.dev/cl/781685","tags":["article"]},{"url":"https://go.dev/issue/79575","tags":["article"]},{"url":"https://pkg.go.dev/vuln/GO-2026-5030","tags":["advisory"]},{"url":"https://access.redhat.com/security/cve/CVE-2026-27137","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2026-27137","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-27137","tags":["advisory"]},{"url":"https://go.dev/cl/752182","tags":["article"]},{"url":"https://go.dev/issue/77952","tags":["article"]},{"url":"https://groups.google.com/g/golang-announce/c/EdhZqrQ98hk","tags":["article"]},{"url":"https://pkg.go.dev/vuln/GO-2026-4599","tags":["advisory"]},{"url":"https://access.redhat.com/security/cve/CVE-2026-33810","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2026-33810","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-33810","tags":["advisory"]},{"url":"https://go.dev/cl/763763","tags":["article"]},{"url":"https://go.dev/issue/78332","tags":["article"]},{"url":"https://groups.google.com/g/golang-announce/c/0uYbvbPZRWU","tags":["article"]},{"url":"https://pkg.go.dev/vuln/GO-2026-4866","tags":["advisory"]},{"url":"https://access.redhat.com/security/cve/CVE-2026-33818","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2026-33818","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-33818","tags":["advisory"]},{"url":"https://go.dev/cl/814980","tags":["article"]},{"url":"https://go.dev/issue/80405","tags":["article"]},{"url":"https://groups.google.com/g/golang-announce/c/94pEornpRlI","tags":["article"]},{"url":"https://pkg.go.dev/vuln/GO-2026-5972","tags":["advisory"]},{"url":"https://access.redhat.com/security/cve/CVE-2026-39820","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2026-39820","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-39820","tags":["advisory"]},{"url":"https://go.dev/cl/759940","tags":["article"]},{"url":"https://go.dev/issue/78566","tags":["article"]},{"url":"https://groups.google.com/g/golang-announce/c/qcCIEXso47M","tags":["article"]},{"url":"https://pkg.go.dev/vuln/GO-2026-4986","tags":["advisory"]},{"url":"https://access.redhat.com/security/cve/CVE-2026-39821","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2026-39821","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-39821","tags":["advisory"]},{"url":"https://go.dev/cl/767220","tags":["article"]},{"url":"https://go.dev/issue/78760","tags":["article"]},{"url":"https://pkg.go.dev/vuln/GO-2026-5026","tags":["advisory"]},{"url":"https://access.redhat.com/security/cve/CVE-2026-42499","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2026-42499","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-42499","tags":["advisory"]},{"url":"https://go.dev/cl/771520","tags":["article"]},{"url":"https://go.dev/issue/78987","tags":["article"]},{"url":"https://pkg.go.dev/vuln/GO-2026-4977","tags":["advisory"]},{"url":"https://access.redhat.com/security/cve/CVE-2026-42502","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2026-42502","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-42502","tags":["advisory"]},{"url":"https://go.dev/cl/781701","tags":["article"]},{"url":"https://go.dev/issue/79572","tags":["article"]},{"url":"https://pkg.go.dev/vuln/GO-2026-5027","tags":["advisory"]},{"url":"https://access.redhat.com/security/cve/CVE-2026-42504","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2484204","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2026-42504","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-42504","tags":["advisory"]},{"url":"https://go.dev/cl/774481","tags":["article"]},{"url":"https://go.dev/issue/79217","tags":["article"]},{"url":"https://groups.google.com/g/golang-announce/c/tKs3rmcBcKw","tags":["article"]},{"url":"https://pkg.go.dev/vuln/GO-2026-5038","tags":["advisory"]},{"url":"https://access.redhat.com/security/cve/CVE-2026-56853","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2026-56853","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-56853","tags":["advisory"]},{"url":"https://go.dev/cl/795540","tags":["article"]},{"url":"https://go.dev/issue/80205","tags":["article"]},{"url":"https://pkg.go.dev/vuln/GO-2026-6089","tags":["advisory"]},{"url":"https://access.redhat.com/security/cve/CVE-2026-56858","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2026-56858","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-56858","tags":["advisory"]},{"url":"https://go.dev/cl/807100","tags":["article"]},{"url":"https://go.dev/issue/80435","tags":["article"]},{"url":"https://pkg.go.dev/vuln/GO-2026-6091","tags":["advisory"]},{"url":"https://access.redhat.com/security/cve/CVE-2026-56859","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2026-56859","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-56859","tags":["advisory"]},{"url":"https://go.dev/cl/803320","tags":["article"]},{"url":"https://go.dev/issue/80481","tags":["article"]},{"url":"https://pkg.go.dev/vuln/GO-2026-6088","tags":["advisory"]},{"url":"https://access.redhat.com/security/cve/CVE-2026-56860","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2026-56860","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-56860","tags":["advisory"]},{"url":"https://go.dev/cl/803681","tags":["article"]},{"url":"https://go.dev/issue/80494","tags":["article"]},{"url":"https://pkg.go.dev/vuln/GO-2026-6218","tags":["advisory"]},{"url":"https://access.redhat.com/security/cve/CVE-2026-56862","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2026-56862","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-56862","tags":["advisory"]},{"url":"https://go.dev/cl/804261","tags":["article"]},{"url":"https://go.dev/issue/80528","tags":["article"]},{"url":"https://pkg.go.dev/vuln/GO-2026-6090","tags":["advisory"]},{"url":"https://errata.rockylinux.org/RLSA-2026:54178","tags":["advisory"]},{"url":"https://www.suse.com/support/update/announcement/2026/suse-su-20263713-1/","tags":["advisory"]},{"url":"https://bugzilla.suse.com/1262187","tags":["report"]},{"url":"https://bugzilla.suse.com/1263272","tags":["report"]},{"url":"https://bugzilla.suse.com/1265827","tags":["report"]},{"url":"https://bugzilla.suse.com/1266615","tags":["report"]},{"url":"https://bugzilla.suse.com/1267416","tags":["report"]},{"url":"https://bugzilla.suse.com/1269917","tags":["report"]},{"url":"https://bugzilla.suse.com/1271327","tags":["report"]},{"url":"https://bugzilla.suse.com/1271331","tags":["report"]},{"url":"https://bugzilla.suse.com/1274221","tags":["report"]},{"url":"https://www.suse.com/security/cve/CVE-2025-12141","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-13149","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-33244","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-33382","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-33814","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-39821","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-39882","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-41607","tags":["web"]},{"url":"https://www.suse.com/support/update/announcement/2026/suse-su-20263714-1/","tags":["advisory"]},{"url":"https://bugzilla.suse.com/1248699","tags":["report"]},{"url":"https://bugzilla.suse.com/1274217","tags":["report"]},{"url":"https://www.suse.com/security/cve/CVE-2022-21698","tags":["web"]},{"url":"https://www.suse.com/support/update/announcement/2026/suse-su-20263718-1/","tags":["advisory"]},{"url":"https://bugzilla.suse.com/1264764","tags":["report"]},{"url":"https://bugzilla.suse.com/1265281","tags":["report"]},{"url":"https://bugzilla.suse.com/1265282","tags":["report"]},{"url":"https://bugzilla.suse.com/1265283","tags":["report"]},{"url":"https://bugzilla.suse.com/1265284","tags":["report"]},{"url":"https://bugzilla.suse.com/1265285","tags":["report"]},{"url":"https://bugzilla.suse.com/1265286","tags":["report"]},{"url":"https://bugzilla.suse.com/1265287","tags":["report"]},{"url":"https://bugzilla.suse.com/1265288","tags":["report"]},{"url":"https://bugzilla.suse.com/1265289","tags":["report"]},{"url":"https://bugzilla.suse.com/1265290","tags":["report"]},{"url":"https://bugzilla.suse.com/1266600","tags":["report"]},{"url":"https://bugzilla.suse.com/1267153","tags":["report"]},{"url":"https://www.suse.com/security/cve/CVE-2025-30153","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-21725","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-25680","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-25681","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-27136","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-28374","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-28376","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-28379","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-28380","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-28383","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-33376","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-33377","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-33378","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-33380","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-33381","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-42502","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-42506","tags":["web"]},{"url":"","tags":["advisory"]},{"url":"https://bugzilla.suse.com/1271557","tags":["report"]},{"url":"https://www.suse.com/security/cve/CVE-2026-8595","tags":["web"]}],"sources":{"cve":[{"id":"CVE-2026-33382","title":"Denial of service via unbounded request body size","description":"Several Grafana API endpoints, some of them unauthenticated, do not limit the size of the request body before processing it. An attacker can send very large payloads that force excessive memory allocation, potentially exhausting memory and causing a denial of service.","status":"published","published":"2026-07-10T14:58:23.329Z","modified":"2026-08-27T17:22:28.355Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"high","assessor":"cna"}],"cwes":["CWE-400"],"updated_at":"2026-11-02T14:20:07.609948Z"}],"euvd":[{"id":"EUVD-2026-42920","description":"Several Grafana API endpoints, some of them unauthenticated, do not limit the size of the request body before processing it. An attacker can send very large payloads that force excessive memory allocation, potentially exhausting memory and causing a denial of service.","status":"published","published":"2026-07-10T14:58:23Z","modified":"2026-08-27T17:22:28Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"high"}],"updated_at":"2026-11-02T18:01:27.27583Z"}],"ghsa":[{"id":"GHSA-xcrv-g5fh-9wx2","title":"Several Grafana API endpoints, some of them unauthenticated, do not limit the size of the request...","description":"Several Grafana API endpoints, some of them unauthenticated, do not limit the size of the request body before processing it. An attacker can send very large payloads that force excessive memory allocation, potentially exhausting memory and causing a denial of service.","status":"published","published":"2026-07-10T18:32:19Z","modified":"2026-07-10T18:32:26Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"high"}],"cwes":["CWE-400"],"updated_at":"2026-11-02T15:09:23.304195Z"}],"nvd":[{"id":"CVE-2026-33382","description":"Several Grafana API endpoints, some of them unauthenticated, do not limit the size of the request body before processing it. An attacker can send very large payloads that force excessive memory allocation, potentially exhausting memory and causing a denial of service.","status":"published","published":"2026-07-10T16:16:29.13Z","modified":"2026-10-25T15:10:00.147Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"high","assessor":"secondary"}],"cwes":["CWE-400"],"updated_at":"2026-11-02T14:12:28.771746Z"}],"osv":[{"id":"ALPINE-CVE-2026-33382","description":"Several Grafana API endpoints, some of them unauthenticated, do not limit the size of the request body before processing it. An attacker can send very large payloads that force excessive memory allocation, potentially exhausting memory and causing a denial of service.","status":"published","published":"2026-07-10T16:16:29.13Z","modified":"2026-11-03T06:32:54.43253729Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"high"}],"updated_at":"2026-11-03T07:16:26.770911Z"},{"id":"CVE-2026-33382","title":"Denial of service via unbounded request body size","description":"Several Grafana API endpoints, some of them unauthenticated, do not limit the size of the request body before processing it. An attacker can send very large payloads that force excessive memory allocation, potentially exhausting memory and causing a denial of service.","status":"published","published":"2026-07-10T14:58:23.329Z","modified":"2026-10-28T02:30:38.31611841Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"high"}],"cwes":["CWE-400"],"updated_at":"2026-11-02T15:45:01.896044Z"},{"id":"RHSA-2026:54178","title":"Red Hat Security Advisory: grafana security, bug fix, and enhancement update","status":"published","published":"2026-08-12T10:16:44Z","modified":"2026-10-10T10:13:33Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"high"}],"updated_at":"2026-11-02T15:53:21.457353Z"},{"id":"RHSA-2026:63164","title":"Red Hat Security Advisory: Red Hat Hardened Images RPMs bug fix and enhancement update","status":"published","published":"2026-09-04T10:13:59Z","modified":"2026-10-20T10:43:34.005601766Z","cvss":[{"version":"3.1","score":8.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","level":"high"}],"updated_at":"2026-11-02T15:53:21.91255Z"},{"id":"RHSA-2026:63165","title":"Red Hat Security Advisory: Red Hat Hardened Images RPMs bug fix and enhancement update","status":"published","published":"2026-09-04T10:14:00Z","modified":"2026-10-20T10:43:34.434174475Z","cvss":[{"version":"3.1","score":8.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","level":"high"}],"updated_at":"2026-11-02T15:53:21.91255Z"},{"id":"RHSA-2026:65157","title":"Red Hat Security Advisory: Red Hat Hardened Images RPMs bug fix and enhancement update","status":"published","published":"2026-09-09T10:20:23Z","modified":"2026-10-20T10:43:35.065366603Z","cvss":[{"version":"3.1","score":8.3,"vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:L","level":"high"}],"updated_at":"2026-11-02T15:53:21.91255Z"},{"id":"RHSA-2026:67517","title":"Red Hat Security Advisory: grafana security update","status":"published","published":"2026-09-16T10:14:49Z","modified":"2026-10-20T10:13:57Z","cvss":[{"version":"3.1","score":8.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:L/A:L","level":"high"}],"updated_at":"2026-11-02T15:53:22.406388Z"},{"id":"RLSA-2026:54178","title":"Moderate: grafana security, bug fix, and enhancement update","description":"Grafana is an open source, feature rich metrics dashboard and graph editor for Graphite, InfluxDB \u0026 OpenTSDB. \n\nSecurity Fix(es):\n\n* grafana: Grafana: Privilege escalation via dashboard overwrite (CVE-2026-33377)\n\n* grafana: Grafana Auth Proxy: Unauthorized access due to incorrect IPv6 allow-list default (CVE-2026-33376)\n\n* grafana: Grafana: Denial of Service via unbounded memory growth in OAuth login route (CVE-2026-8609)\n\n* grafana: Grafana: Denial of Service via excessive memory allocation from large API request payloads (CVE-2026-33382)\n\nBug Fix(es) and Enhancement(s):\n\n* [grafana / rhel-10.2.z] Remove Lua ExclusiveArch macro for Konflux build (JIRA:Rocky Linux-188282)\n\nFor more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.","status":"published","published":"2026-08-13T12:07:38.295651Z","modified":"2026-08-13T12:30:03.570416484Z","cvss":[{"version":"3.1","score":7.4,"vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N","level":"high"}],"updated_at":"2026-11-02T15:53:26.111232Z"},{"id":"ALSA-2026:54178","title":"Moderate: grafana security, bug fix, and enhancement update","description":"Grafana is an open source, feature rich metrics dashboard and graph editor for Graphite, InfluxDB \u0026 OpenTSDB.   \n\nSecurity Fix(es):  \n\n  * grafana: Grafana: Privilege escalation via dashboard overwrite (CVE-2026-33377)\n  * grafana: Grafana Auth Proxy: Unauthorized access due to incorrect IPv6 allow-list default (CVE-2026-33376)\n  * grafana: Grafana: Denial of Service via unbounded memory growth in OAuth login route (CVE-2026-8609)\n  * grafana: Grafana: Denial of Service via excessive memory allocation from large API request payloads (CVE-2026-33382)\n\n\nBug Fix(es) and Enhancement(s):  \n\n  * [grafana / rhel-10.2.z] Remove Lua ExclusiveArch macro for Konflux build (JIRA:AlmaLinux-188282)\n\n\nFor more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.\n","status":"published","published":"2026-08-12T00:00:00Z","modified":"2026-10-29T11:42:23.616070713Z","updated_at":"2026-11-02T15:27:54.753319Z"},{"id":"BIT-grafana-2026-33382","title":"Denial of service via unbounded request body size","description":"Several Grafana API endpoints, some of them unauthenticated, do not limit the size of the request body before processing it. An attacker can send very large payloads that force excessive memory allocation, potentially exhausting memory and causing a denial of service.","status":"published","published":"2026-07-14T08:45:29.334Z","modified":"2026-09-08T08:47:51.640707962Z","updated_at":"2026-11-02T15:28:31.02759Z"},{"id":"CLSA-2026-1792757203","title":"grafana: Fix of 5 CVEs","description":"- CVE-2026-33382: cap JSON bodies read by web.Bind at 100 MiB and pre-auth\n  login, signup, password reset and invite bodies at 100 KiB","status":"published","published":"2026-10-23T12:07:03Z","modified":"2026-10-26T09:31:02.824443991Z","updated_at":"2026-11-02T15:43:54.981307Z"},{"id":"openSUSE-SU-2026:11277-1","title":"grafana-12.4.5-1.1 on GA media","description":"These are all security issues fixed in the grafana-12.4.5-1.1 package on the GA media of openSUSE Tumbleweed.","status":"published","published":"2026-07-15T00:00:00Z","modified":"2026-07-16T10:00:17.624581136Z","updated_at":"2026-11-02T16:58:38.95195Z"},{"id":"openSUSE-SU-2026:21366-1","title":"Security update for grafana","description":"This update for grafana fixes the following issues:\n\nChanges in grafana:\n\n- CVE-2026-33382: Limit the size of the request body before processing it at several Grafana API endpoints (bsc#1271331)\n- CVE-2026-8595: Fix stored XSS in the table panel (bsc#1271557)\n","status":"published","published":"2026-07-17T10:42:53Z","modified":"2026-07-19T18:24:10.658008505Z","updated_at":"2026-11-02T16:58:41.885092Z"},{"id":"SUSE-SU-2026:3713-1","title":"Security update for Multi-Linux Manager Client Tools - Monitoring stack","description":"This update fixes the following issues:\n\ngolang-github-prometheus-alertmanager:\n\n- CVE-2026-39821: Fix validation bypass and privilege escalation by  updating golang.org/x/net to version 0.55.0 (bsc#1266615)\n\ngolang-github-prometheus-prometheus updated from version 3.5.3 to 3.5.4:\n    \n- Security fixes:\n\n  - CVE-2026-39882: Fix reading unbounded HTTP response bodies by bumping OpenTelemetry to 1.43.0 (bsc#1274221)\n  - CVE-2026-33244: Fix improper neutralization of the HTTP Location header value in react-router (bsc#1267416)\n  - CVE-2026-13149: Prevent potential DoS by bumping brace-expansion to version 5.0.7 (bsc#1269917)\n  - CVE-2026-33814: Fix infinite loop in HTTP/2 transport (bsc#1265827)\n    \n- Other bugs fixed and changes:\n\n   * STACKIT SD: Fix secrets being exposed in plaintext via /-/config endpoint\n   * Chore: Bump golang.org/x/net to version 0.55.0\n\ngrafana updated from version 11.6.14+security04 to version 12.4.5:\n\nSecurity fixes:\n\n- CVE-2026-39882: Prevent memory exhaustion DoS in OpenTelemetry OTLP HTTP exporters (bsc#1274217)\n- CVE-2026-33382: Limit the size of the request body before processing it at several Grafana API endpoints (bsc#1271331)\n- CVE-2025-12141: Fixed information leakage in Grafana Alerting (bsc#1262187)\n- CVE-2026-41607: Fix potential information disclosure in Apache Thrift (bsc#1263272)\n\nBreaking chahnges introduced in version 12.0.0:\n\n- BREAKING: Removed AngularJS and all deprecated UI Extensions  APIs.\n- BREAKING: Enforced stricter version compatibility checks in plugin CLI install commands.\n- BREAKING: Enabled the failWrongDSUID feature flag by default, which rejects data sources with incorrect UIDs.\n\nOther changes introduced from version 11.6.14+security04 to version 12.4.5 (jsc#PED-16512):\n\n- Add Legal-Review-Notice (bsc#1271327)\n- Datasources: return 400 when payload UID does not match URL UID in PUT /api/datasources/uid/:uid\n- Analytics: Keep internal dashboard id.\n- Reporting: Correctly apply appSubURL to report settings requests\n- Alerting: Document Grafana HA Alertmanager cluster metrics prefix change.\n- Dependency updates to core plugins and UI libraries.\n- Updates to data source provisioning and dashboard schemas.\n- Introduced dynamic dashboards in public preview.\n- Added a new side toolbar that replaces the second top toolbar to provide additional vertical space.\n- Added the ability to create dashboards from templates using sample data.\n- Revamped the gauge visualization with rounded bars, configurable bar thickness, and endpoint markers.\n- Added support to map one variable to multiple values.\n- Released a completely redesigned logs visualization.\n- Added the ability to export dashboards directly as PNG images.\n- Introduced an interactive learning experience within the Grafana UI.\n- Added a Switch template variable type to quickly toggle between values in queries.\n- Added functionality to style table cells using CSS properties via the field cell option.\n- Added support for Entra Workload Identity to enhance authentication capabilities with federated credentials.\n- Redesigned the alert rule list page.\n- Renamed Mute Timings to Active Time Intervals in Grafana Alerting.\n- Added support for Service Account Impersonation in the BigQuery data source.\n- Introduced the Grafana Advisor in public preview.\n- Introduced a new dashboard schema to replace the original single grid layout.\n- MIGRATION: Triggered a full-table rewrite for the annotation table, which may temporarily increase disk usage.\n","status":"published","published":"2026-08-24T02:53:30Z","modified":"2026-08-24T17:30:04.93156196Z","updated_at":"2026-11-02T15:54:05.392906Z"},{"id":"SUSE-SU-2026:3714-1","title":"Security update for Multi-Linux Manager Monitoring stack","description":"This update fixes the following issues:\n\nprometheus-postgres_exporter:\n\n- CVE-2022-21698: Replace github.com/prometheus/client_golang with version 1.11.1 and prevent validation bypass \n  and privilege escalation (bsc#1248699)\n\ngolang-github-prometheus-alertmanager:\n\n- CVE-2026-39821: Fix validation bypass and privilege escalation by  updating golang.org/x/net to version 0.55.0 (bsc#1266615)\n\ngolang-github-prometheus-prometheus was updated from version 3.5.3 to 3.5.4:\n\nSecurity fixes:\n\n- CVE-2026-39882: Fix reading unbounded HTTP response bodies by bumping OpenTelemetry to 1.43.0 (bsc#1274221)\n- CVE-2026-33244: Fixed improper neutralization of the HTTP Location header value in react-router (bsc#1267416)\n- CVE-2026-13149: Prevent potential DoS by bumping brace-expansion to version 5.0.7 (bsc#1269917)\n- CVE-2026-33814: Fixed infinite loop in HTTP/2 transport (bsc#1265827)\n\nOther changes and fixes:\n    \n- STACKIT SD: Fixed secrets being exposed in plaintext via /-/config endpoint\n- Chore: Bump golang.org/x/net to version 0.55.0\n\ngrafana updated from version 11.6.14+security04 to version 12.4.5:\n\nSecurity fixes:\n\n- CVE-2026-33382: Limit the size of the request body before processing it at several Grafana API endpoints (bsc#1271331)\n- CVE-2026-39882: Prevent memory exhaustion DoS in OpenTelemetry OTLP HTTP exporters (bsc#1274217)\n- CVE-2025-12141: Fixed information leakage in Grafana Alerting (bsc#1262187)\n- CVE-2026-41607: Fix potential information disclosure in Apache Thrift (bsc#1263272)\n\nBreaking chahnges introduced in version 12.0.0:\n\n- BREAKING: Removed AngularJS and all deprecated UI Extensions  APIs.\n- BREAKING: Enforced stricter version compatibility checks in plugin CLI install commands.\n- BREAKING: Enabled the failWrongDSUID feature flag by default, which rejects data sources with incorrect UIDs.\n\nOther changes introduced from version 11.6.14+security04 to version 12.4.5 (jsc#PED-16512):\n\n- Add Legal-Review-Notice (bsc#1271327)\n- Datasources: return 400 when payload UID does not match URL UID in PUT /api/datasources/uid/:uid\n- Analytics: Keep internal dashboard id.\n- Reporting: Correctly apply appSubURL to report settings requests\n- Alerting: Document Grafana HA Alertmanager cluster metrics prefix change.\n- Dependency updates to core plugins and UI libraries.\n- Updates to data source provisioning and dashboard schemas.\n- Introduced dynamic dashboards in public preview.\n- Added a new side toolbar that replaces the second top toolbar to provide additional vertical space.\n- Added the ability to create dashboards from templates using sample data.\n- Revamped the gauge visualization with rounded bars, configurable bar thickness, and endpoint markers.\n- Added support to map one variable to multiple values.\n- Released a completely redesigned logs visualization.\n- Added the ability to export dashboards directly as PNG images.\n- Introduced an interactive learning experience within the Grafana UI.\n- Added a Switch template variable type to quickly toggle between values in queries.\n- Added functionality to style table cells using CSS properties via the field cell option.\n- Added support for Entra Workload Identity to enhance authentication capabilities with federated credentials.\n- Redesigned the alert rule list page.\n- Renamed Mute Timings to Active Time Intervals in Grafana Alerting.\n- Added support for Service Account Impersonation in the BigQuery data source.\n- Introduced the Grafana Advisor in public preview.\n- Introduced a new dashboard schema to replace the original single grid layout.\n- MIGRATION: Triggered a full-table rewrite for the annotation table, which may temporarily increase disk usage.\n","status":"published","published":"2026-08-24T02:55:28Z","modified":"2026-11-10T17:23:21.319856144Z","updated_at":"2026-11-10T17:35:04.393608Z"},{"id":"SUSE-SU-2026:3718-1","title":"Security update for grafana","description":"This update for grafana fixes the following issues:\n\ngrafana updated from version 11.6.14+security04 to version 12.4.5:\n\nSecurity fixes:\n\n- CVE-2026-39882: Prevent memory exhaustion DoS in OpenTelemetry OTLP HTTP exporters (bsc#1274217)\n- CVE-2026-33382: Limit the size of the request body before processing it at several Grafana API endpoints (bsc#1271331)\n- CVE-2025-12141: Fixed information leakage in Grafana Alerting (bsc#1262187)\n- CVE-2026-41607: Fix potential information disclosure in Apache Thrift (bsc#1263272)\n\nBreaking chahnges introduced in version 12.0.0:\n\n- BREAKING: Removed AngularJS and all deprecated UI Extensions  APIs.\n- BREAKING: Enforced stricter version compatibility checks in plugin CLI install commands.\n- BREAKING: Enabled the failWrongDSUID feature flag by default, which rejects data sources with incorrect UIDs.\n\nOther changes introduced from version 11.6.14+security04 to version 12.4.5 (jsc#PED-16512):\n\n- Add Legal-Review-Notice (bsc#1271327)\n- Datasources: return 400 when payload UID does not match URL UID in PUT /api/datasources/uid/:uid\n- Analytics: Keep internal dashboard id.\n- Reporting: Correctly apply appSubURL to report settings requests\n- Alerting: Document Grafana HA Alertmanager cluster metrics prefix change.\n- Dependency updates to core plugins and UI libraries.\n- Updates to data source provisioning and dashboard schemas.\n- Introduced dynamic dashboards in public preview.\n- Added a new side toolbar that replaces the second top toolbar to provide additional vertical space.\n- Added the ability to create dashboards from templates using sample data.\n- Revamped the gauge visualization with rounded bars, configurable bar thickness, and endpoint markers.\n- Added support to map one variable to multiple values.\n- Released a completely redesigned logs visualization.\n- Added the ability to export dashboards directly as PNG images.\n- Introduced an interactive learning experience within the Grafana UI.\n- Added a Switch template variable type to quickly toggle between values in queries.\n- Added functionality to style table cells using CSS properties via the field cell option.\n- Added support for Entra Workload Identity to enhance authentication capabilities with federated credentials.\n- Redesigned the alert rule list page.\n- Renamed Mute Timings to Active Time Intervals in Grafana Alerting.\n- Added support for Service Account Impersonation in the BigQuery data source.\n- Introduced the Grafana Advisor in public preview.\n- Introduced a new dashboard schema to replace the original single grid layout.\n- MIGRATION: Triggered a full-table rewrite for the annotation table, which may temporarily increase disk usage.\n","status":"published","published":"2026-08-24T09:23:40Z","modified":"2026-08-26T18:23:35.632543325Z","updated_at":"2026-11-02T15:54:05.392906Z"}]}}