CVE-2026-21728
Tempo query limit results in unbounded memory allocation
- State
- Published
- Severity
- 7.5 High
- Published
- Apr 24, 2026
- Updated
- Sep 9, 2026
- Reserved
- Jan 5, 2026
Description
Tempo queries with large limits can cause large memory allocations which can impact the availability of the service, depending on its deployment strategy.
Mitigation can be done by setting max_result_limit in the search config, e.g. to 262144 (2^18). Alternatively, automatically restart the service.
Scores
| CVSS | Score | Vector | Source |
|---|---|---|---|
| 3.1 | 7.5 High | CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H | GRAFANA |
| 3.1 | 7.5 High | CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H | redhat-SADP |
Weaknesses
Affected Products
| Product | Versions |
|---|---|
TempoGrafana |
|
Enterprise Traces (GET)Grafana |
|
References
- https://grafana.com/security/security-advisories/cve-2026-21728vendor-advisory
- https://access.redhat.com/security/cve/CVE-2026-21728vdb-entry
- RHBZ#2461395issue-tracking
- https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-21728.json
- https://access.redhat.com/errata/RHSA-2026:22423vendor-advisory
- https://access.redhat.com/errata/RHSA-2026:22347vendor-advisory
- https://access.redhat.com/errata/RHSA-2026:23345vendor-advisory
- https://access.redhat.com/errata/RHSA-2026:24503vendor-advisory
- https://access.redhat.com/errata/RHSA-2026:21769vendor-advisory
Every record here comes from the CVE Program’s CVE List. © 1999–2026 The MITRE Corporation. CVE is a registered trademark of The MITRE Corporation. The records are reproduced under the CVE Program terms of use.