Medium severity6.5NVD Advisory· Published Oct 13, 2026· Updated Oct 13, 2026

CVE-2026-33374

Description

The Prometheus rule conversion API endpoints in Grafana do not limit request body size, allowing authenticated users to trigger unbounded memory allocations that can crash the server through out-of-memory conditions.

Affected products

Grafana/Grafanallm-fuzzy

Patches

Vulnerability mechanics

References

grafana.com/security/security-advisories/cve-2026-33374nvd

News mentions

No linked articles in our index yet.

cvss	0.423
epss	0.000
exploit	0.000
kev	0.000
patch	0.000
ransomware	0.000