CVE-2026-28383
A request to the Grafana plugin resources endpoint can cause unbounded memory allocation by reading the entire request body into memory.
Published May 13, 2026 · updated Jun 17, 2026 · grafana grafana
A request to the Grafana plugin resources endpoint can cause unbounded memory allocation by reading the entire request body into memory. An authenticated user can exploit this to trigger an out-of-memory condition, potentially causing a denial of service.
Code
The project this record applies to. Exploit listings stay in References.
No public source repository is identified for this product.
Timeline
Detection, updates, and resolution for this record.
May 13, 2026 · NIST NVD
Detected
A request to the Grafana plugin resources endpoint can cause unbounded memory allocation by reading the entire request body into memory. An authenticated user can exploit this to trigger an out-of-memory condition, potentially causing a denial of service.
Jun 17, 2026 · NIST NVD
Updated
A request to the Grafana plugin resources endpoint can cause unbounded memory allocation by reading the entire request body into memory. An authenticated user can exploit this to trigger an out-of-memory condition, potentially causing a denial of service.
Affected
- cpe grafana/grafanaversion unspecified
- cpe grafana/grafana11.6.14
- cpe grafana/grafana12.2.8
Sources
- CVE.orgVulnerability recordCVE-2026-28383
Official CVE identifier
cve.org - NIST NVDVulnerability recordCVE-2026-28383
A request to the Grafana plugin resources endpoint can cause unbounded memory allocation by reading the entire request body into memory. An authenticated user can exploit this to trigger an out-of-memory condition, potentially causing a denial of service.
nvd.nist.gov