Medium severity6.5NVD Advisory· Published May 13, 2026· Updated Jun 2, 2026
CVE-2026-28383
CVE-2026-28383
Description
A request to the Grafana plugin resources endpoint can cause unbounded memory allocation by reading the entire request body into memory. An authenticated user can exploit this to trigger an out-of-memory condition, potentially causing a denial of service.
AI Insight
LLM-synthesized narrative grounded in this CVE's description and references.
Affected products
6- osv-coords5 versionspkg:apk/chainguard/grafana-12.4pkg:apk/wolfi/grafana-12.4pkg:bitnami/grafanapkg:rpm/opensuse/grafana&distro=openSUSE%20Leap%2016.0pkg:rpm/opensuse/grafana&distro=openSUSE%20Tumbleweed
< 12.4.3.02-r0+ 4 more
- (no CPE)range: < 12.4.3.02-r0
- (no CPE)range: < 12.4.3.02-r0
- (no CPE)range: >= 6.7.0, < 11.6.14
- (no CPE)range: < 11.6.14+security04-bp160.1.1
- (no CPE)range: < 11.6.14+security04-1.1
Patches
Vulnerability mechanics
References
1- grafana.com/security/security-advisories/cve-2026-28383nvdVendor Advisory
News mentions
0No linked articles in our index yet.